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PREFACE 


Thu  Vedinical  report  wai  prepared  for  the  Air  Force  Flifh.t  Dynamics  l^boratorv  and 
the  Aeronautical  Syatema  Diviaion  at  an  tntenli*nt<onal  etTort  by  The  Boeing  Cuinpauv  in 
fuinUment  of  AFFDL  Contract  F336I5-72-C-1090. 

Pnneipat  authors  of  thu  report  are  lames  L Townsend.  Boemg-Wichita  and  Eugene  T 
Raymond,  Boeing* Seattle.  Several  other  Boeing  enmiecrs  authored  subsections  of  the  draft 
MIL-F-9490D.  whKh  it  included  at  a part  of  this  techn.jal  report  Included  are  J MeWha.  J Bi>one. 
D.  Martin  and  K.  Mitchell.  Seattle,  F Moffett  Wichiu  and  H.  McCafferty  and  W Eason. 
Philadclphta. 


This  effort  was  guided  by  a joint  AFFDL-AST  steering  committee  Paul  E Blatt. 
AFFDL.  and  Joseph  A.  Farrit.  ASD,  were  the  steering  committee  co-chairmen.  Thomas  D Lewis 
was  the  project  monitor  Other  committee  members  mcluded  Ron  Anderson,  Boh  Woodcock  Bill 
Brovin  and  Frank  George  of  the  AFFDL  and  Don  Sovine  of  ASD 
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SECTION  I 


INTRODUCTION 


.nld  document  is  published  in  support  of  Military  Specification  MIL- 
F->490D,  "Flight  Control  Sysi:ems  - Design,  Installation  and  Test  of  Piloted 
Aircraft,  General  Specification  For".  The  Air  Force  Flight  Dynamics  Lab- 
oratory, with  the  contracted  help  of  The  Boeing  Company,  has  conducted  a 
two  year  revision  effo-  to  update  MIL-F-9A90.  The  purpose  of  this  document 
is  to  explain  the  philosophy  and  data  used  to  update  the  specification  and 
to  aid  the  MIL-F-9490  user  in  interpreting  the  requirements.  The  current 
Military  Specification  shall  apply  in  the  event  of  conflict  with  this 
document . 


Discussion  sections  are  included  in  this  document  for  each  requirement 
or  sequence  of  related  requirements,  following  the  organization  and  outline 
of  MIL-F-9490D.  Where  pertinent,  general  dlscu&.slons  are  included'  to 
explain  the  philosophy  behind  major  changes  In  MIL-F-9490C  requirements. 
Appendices  are  included  which  discusr  detailed  information  on  special  sub- 
jects such  as  reliability. 

The  revision  effort  was  Initiated  in  early  1972  with  a series  of  meet- 
ings between  the  Air  Force  and  Boeing  to  establish  an  overall  revision 
philosophy.  These  meetings  at  Wright-Pattei son  Air  Force  Base  were  extended 
in  April  1972  to  include  the  following  members  of  Industry. 


11  April 

11  April 

12  April 

13  April 

14  April 
18  April 

18  April 

19  April 

20  April 

21  April 
21  April 


General  Dynamics  (Fort  Wort'*) 

Honeywell 

Sikorsky 

Lockheed -Georgia 

North  American  Rockwell 

Sperry 

General  Electric 
Bend lx 

McDonnell  (St.  Louis) 

Calspan  Corporation 
Vought  Aeronautics 


Fairchild  Republic  Division,  although  unable  to  attend  the  AF/Industry 
Meetings,  submitted  written  recommendations  on  19  April.  This  series  of 
meetings,  provided  a cross-section  of  opinion  from  the  industry  on  the  defi- 
ciencies of  the  existing  specification  and  provided  a base  for  the  initial 
revision  effort. 


Visits  to  the  General  Dynamics  (Fort  Worth)  and  North  American  Rockwell 
(Los  Angeles)  plants  were  made  during  May  to  follow-up  on  recononendations 
made  during  the  AF/Industry  meetings. 

On  June  6 and  7 a series  of  Boeing  internal  MIL-F-9490  meetings  were 
held  in  Seattle.  The  purpose  of  these  meetings  was  to  discuss  the  general 
content  to  be  Included  in  major  specification  subsections  and  to  identify 
individuals  responsible  for  initial  drafts.  Follow-on  meetings  between  the 
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AFFDL  steering  committee  and  Boeing  were  held  approximately  quarterly  for 
the  next  two  years  as  drafts  of  the  Dser's  Guide  and  Specification  evolved. 

As  the  draft  approached  completion,  the  Air  Force  submitted  it  to 
pertinent  members  of  Industry  and  government  for  review  and  coruroent . A 
first  review  took  place  in  the  Fall  of  1973  and  the  second  and  final  review 
was  accomplished  during  April  and  May  of  1974.  The  comments  received  were 
considered  by  the  Air  Force  steering  committee  and  Integrated  into  the  drafts 
by  the  authors  where  pertinent. 

From  the  Initial  planning,  the  revision  of  MIL-F-9490  was  based  upon  a 
philosophy  of  the  "LOGICAL  DEVELOPMENT  SEQUENCE"  of  sound  engineering 
practice  from  which  most  successful  flight  control  systems  evolve.  Most  air- 
frame primes  already  practice  the  procedures  outlined  and  will  not  have  to 
undertake  additional  tasks  in  MIL-F-9490  with  which  they  are  unfamiliar. 

Once  a contract  is  awarded  for  a new  weapon  system,  the  LOGICAL  DEVELOPMENT 
SEQUENCE  as  shown  in  Figure  ID  consists  of: 

a.  A detailed  Flight  Control  System  Specification  prepared  by  the 
contractor  which  establishes  the  flight  control  functions,  performance, 
reliability  safety,  maintainability,  and  survivability  requirements  to 
satisfy  mission  requirements  and  performance  established  by  the  contract 
work  statement.  It  is  intended  that  this  be  a viable  document  updated  as 
necessary  throughout  the  design  process  to  reflect  changes  which  become 
apparent  as  the  system  design  matures. 

b.  Design  phase  to  implement  the  detailed  requirements  established  by 
the  Flight  Control  System  Sper-'ficatlon.  Analysis  is  performed  in  conjunc- 
tion with  the  design  phase  to  satisfy  stability,  performance,  reliability, 
safety,  maintainability,  survivability  and  cost  requirements.  Component 
designs  are  established.  Pilot-in-the-loop  simulations  are  conducted 
employing  math  models  of  the  control  system  to  verify  the  flying  quality  and 
human  factor  elements  of  the  design  under  realistic  mission  task  formulation. 
Make  or  buy  component  and  system  hardware  specifications  are  produced  from 
this  phase  of  the  development . 

c.  . Fabrication  and  assembly  of  components  accompanied  by  qualification 
and/or  flight-worthiness  tests  of  equipment. 

d.  Repeat  of  pilot-ln-the-loop  simulation  tests  v;ith  flight  hardware 
Interconnected  to  the  computer  simulation  of  the  aircraft  dynamics.  Final 
tests  would  be  combined  with  an  operational  raockup  (iron-bird)  realistically 
evaluating  total  flight  control  system  operation  under  proper  loading  of 

the  actuators  and  electrical  and  hydraulic  power  supplies.  Note  that  the 
operational  mockup  can  be  the  same  test  rig  required  by  MIL-H-5440  Hydraulic 
Systems  Specification.  Failure  effects  of  the  flight  control  system  would 
also  be  evaluated  on  this  test  rig. 

e.  Installation  of  the  FCS  into  the  aircraft  and  ground  tests  to  verify 
the  operation.  Ground  testing  would  Include  frequency  response,  structural 
effects,  gain  margin  (limit  cycle),  and  EMI  tests  in  the  aircraft  prior  to 
test  flight. 
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AF/Contractor  InteractlOQ  dnrlng  derelopment  process 


t.  Flight  tests  throughout  the  specified  flight  envelope  end  mission 
correlation  should  be  msintalned  throughout  the  flight  phase  with  analysis 
and  simulator  results. 

While  the  actual  development  sequence  is  rarely  a clear-cut  scries  of 
events  but  most  often  results  in  an  iterative  redesign  and  redefine  dislgn 
cycle  with  many  phases  going  on  simultaneously  In  parallel,  this  structure 
serves  as  the  framework  for  the  MIL-F-9490  revision  and  major  documentation 
sources.  Also,  the  LOGICAL  DEVELOPMENT  SEQt'ENCE  is  based  upon  flight  con- 
trol requirements  for  major  production  aircraft  developments.  For  less 
stringent  progr.-.ms  such  as  advanced  developments,  prototype  aircraft,  experi- 
mental aircraft,  off-the-shelf  aircraft  buys,  etc.,  the  procuring  agency 
may  elect  tc  bypass  particular  design  requirements  end  some  if  the  rigorous 
seeps  in  development  or  in  documentation.  In  those  cases,  exception  will  be 
taken  in  the  contract  designating  thoae  phases  which  will  be  exempted. 

Freedom  is  to  be  allowed  to  the  flight  control  system  designer  to 
select  the  mechanitation  techniques,  redundancy  requiramenta , and  analysis 
methods  wtiich  best  satisfy  overall  aircraft  perforisance,  mission  tasks, 
safety,  m-iintainabillty , and  cost  constraints.  Once  the  designer  has 
selected  his  technical  approach,  MlL-F-9490  contains  three  sections  consist- 
ing of  System,  Subsystem,  and  Component  requirements  based  on  past  experience 
and  recent  fliglh.  control  technology  developments  which  are  to  govern  the 
final  development  and  test  effort. 

Figure  ID  also  defines  the  Air  Force/contractor  interactions  desired 
throughout  the  LOGICAL  DEVELOPMENT  SEQUENCE  for  the  fUght  control  system. 

The  objective  is  to  establish  key  milestones  throughout  the  development  and 
te.st  cycle  which  will  provide  the  Air  Force  assurance  that  the  end  design 
will  satisfy  the  requirements  rather  than  discovering  design  deficiencies  in 
tht>  flight  test  or  operational  stages.  Ll cumentation  has  been  identified 
at  key  points  throughout  the  development  cycle  and  mist  be  periodically 
updated  as  the  system  design  matures.  Documentation  consists  of: 

a.  FCS  Dijvelcpment  Plan 

b.  FCS  System  Specification 

c.  Analysis  Report  (Including  reliability,  maintainability,  safety, 
survivability,  and  simulation  results) 

d.  FCS  Qualification  and  Inspection  Report 

c.  Final  Test  Report  (Includes  ground  ano  flight  test  results) 

Only  those  documents  specified  in  the  DD  1423  Contract  Data  Requirements 
List  for  the  specific  procurement  are  required  deliverable  items. 

Factors  relating  to  particular  classifications  and  requiremanta  of 
MlL-F-9490  will  be  specified  in  advance  by  the  Air  Force  for  a specific  pro- 
curement. Typical  factors  to  be  provided  by  the  government  Include: 

a.  Mission  scenario  which  Is  relatable  to  control  law  performance  for 
specific  mission  tasks.  Total  environment  such  as  anticipated  global 
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deployuient  and  enemy  retaliation  threat  ahould  also  be  included.  Quantita- 
tive mission  tasks  performance  such  as  unguided  weapon  delivery  criteria 
may  be  specified  which  impact  the  design  of  the  flight  control  system. 

b.  Flight  Control  System  Operation  States 

c . AFSC  Medo j 

d.  Reliability,  Maintainability,  Safety,  Survivability  and  Cost  Con- 
straints. (Normally  these  factors  are  presented  in  terms  of  entire  weapon 
system  requirement.,  and  the  contractor  must  budget  each  subsystem  require- 
ment accjrdingly. 

The  specification  has  been  organized  around  the  major  topico  of  system 
requirements,  subsystem  requirements  and  component  requirements.  The  organi- 
zation tree  shewn  below  illustrates  this  general  organization. 


The  first  tier  breakdown  is  standard,  including  scope,  classifications, 
applicable  documents,  requirements,  quality  assurance  provisions,  preparation 
for  delivery  and  notes.  Within  the  requirements  section,  those  requirements 
most  Important  to  system  designers  have  been  separated  from  requirements 
governing  subsystem  and  component  design.  This  was  done  in  recognition  that 
many  prime  contractors  use  separate  organizations  for  FCS  synthesis  and  design 
and  for  subsystem  and  component  design.  It  must  be  recognized  that  the  entire 
specification  contains  interrelated  requirements  which  must  be  considered  by 
each  design  team  involved  in  the  design  process.  One  of  the  challenges  of 
modern  complex  FCS  design  is  to  insure  that  communication  within  the  inter- 
relating technologies  exists  and  that  formal  organizational  structure  does  not 
prohibit  or  discourage  interdisciplinary  interaction  at  the  working  level. 

System  requirements  include  performance  and  design.  One  of  the  major 
expansions  made  under  this  revision  was  a comprehensive  coverage  of  the 
"ilitles"  at  the  system  level.  System  level  failure  immunity  and  other 
design  requirements  also  received  considerable  attention.  The  organization 
tree  shown  below  illustrates  coverage  included  under  system  requirem.»nts . 
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Many  of  theHe  raqulrananta  art  stated  In  taraa  of  ptobabll It l«s  and  th« 
term  "extremely  remote"  it  often  used.  In  ea^.-h  procurement,  this  term  will 
havr  a quantitative  value  at  tpecified  by  the  procuring  activity.  This  and 
vHher  terma  arc  defined  in  6.b  of  the  tpecif ication. 


SYSTEM 

REQUIREMENTS 


3 l.l 

3.1.2 

>.1.3 

MANUAL  FCS 

AFCS 

GENERAL 

performance: 

PERFORMANCE 

ECS  DE  SIGN 

J.1.4 

MANUAL 
ECS  DESIGN 


Subsystem  requirements  Include  pilot  controls  and  displays,  sensors, 
signal  transmission  and  computation,  control  power  and  actuation  require- 
ments. The  organization  tree  shown  below  Illustrates  this  coverage. 


SURSYSTEM 

REQUIREMENTS 


3.2.1 

MLOr  CONTROLS 
AND  DISPLAYS 


3.2.2 

SENSORS 


SIGNAL 

TRANSMISSION 


3.2.4 

SIGNAL 

COMPUTATION 


32.3 

CONTROL 

POWER 


3.2.4 

ACTUATION 


Coaponcnc  design,  fabr lest  ion  and  installation  ars  included  undvr  com- 
ponent rsquiraaants  in  3.2.7  through  3.2.9.  Frequent  reference  to  sporlfl> 
paragraphs  of  the  AFCS  Dosign  Handbooks  was  aade  in  this  aren  and  through. 'ut 
the  specification  where  additional  design  guidance  (s  needed. 

Classifications  uued  in  M1L-F-9490D  include  FCS  types.  FC.‘^  i)p,  i at  li'u.i  1 
States  and  FCS  criticalities.  PCS  types  are  separated  into  Manual  and  Auto~ 
atstic  FCS  bused  on  whether  or  not  active  pilot  Inputs  are  involved. 

Five  FCS  Operational  States  are  used  to  sp'v.ifv  requirement.  These 
states  are  illustrated  below  with  key  characteristics  noted. 


Three  criticality  classifications  were  adopted  to  organize  requlr«inient s . 
Essential,  flight  phase  essential  and  noncrltical  .FCS  functions  are  defined. 
The  key  separation  is  whether  the  function  is  needed  to  Insure  flight  safety 
either  full  time,  only  during  certain  flight  phases  or  not  at  all.  These 
classifications  are  defined  in  Section  1.0  of  the  specification. 
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SECTION  n 


\ 


STATEMENT  AND  DISCI’SSION  OF  REVi.  m»HENTS 


I SCOPE 

1>1  Sv . Till*  sp«>c  1(  Ion  viitabl ish***  general  performancr,  design, 
development  and  quality  assurance  requirements  for  the  flight  control  sya~ 
teiBfi  v'f  I SAF  stat.ned  piloted  aircraft.  Flight  control  systems  (FCS)  liicluoe 
all  component s used  to  transmit  flight  control  commands  from  the  pilot  or 
other  Sources  to  appropriate  force  and  moment  producers.  Flight  control 
ci>mmanda  may  result  In  control  of  aircraft  flight  path,  attitude,  airspeed, 
aerodynamic  conf igurat ion,  ride,  and  structural  modes.  *JSong  components 
included  ate  the  pilot's  controls,  dedlcat>'d  displays  and  logic  switching, 
trunsducers,  system  dvnamlc  and  air  data  sensors,  signal  computation,  test 
devices,  tranamission  devices,  actuators,  and  signal  transmission  lines 
dedicated  tc  (light  control.  Excluded  are  aerodynamic  surfaces,  engines, 
helicopter  totorh.  tire  control  devices,  crew  displays  and  electronics  not 
dcdic.tted  to  (light  control . The  Interfaces  of  flight  control  systems  with 
related  subsystems  are  defined. 

I'lsassioN 

The  scope  for  this  H1L-F-'1A90  revision  remains  essentially  the  same  as 
In  MIL-E-d;<10C . Structural  mode  control  and  control  of  aerodynamic  conf  Ig- 
urat ion  have  been  emphasized  In  the  scope  statement  since  there  have  been 
advances  in  these  areas  In  recent  years. 

The  hev  to  the  definition  of  a flight  control  system  Is  the  term  "all 
components  used".  The  partial  listing  given  is  not  meant  to  be  complete. 

In  each  procurement  a decision  on  wliat  components  are  used  to  transmit 
commands  must  he  nude.  Definition  oi  Interfaces  and  their  characteristics 
must  also  he  established. 

lntcrl.«ce.s  of  flight  controls  with  other  subsystems  must  be  considered 
bv  the  contractor  in  meeting  many  of  the  requirements  of  HlL-F-9490.  Rella- 
bllitv  and  failure  Immunity  requirements,  for  example,  require  that  failure 
effects  In  nondedicated  subsystems  be  co.,i.idered  when  such  effects  can  Impact 
t light  contri'ls. 

' ’ • C lassl f Icat Ion 

I . J . 1 Flight  control  system  (FCS)  closslf Icatlons 

l.J.l.l  M.inu.sl  f’lght  control  systems  (MFCS).  Manual  Flight  Control  Systems 
consist  of  electrical,  mechanical  and  hydraulic  components  which  transmit 
pilot  control  commands  cr  generate  anu  convey  commands  which  augment  pilot 
control  commands,  and  thereby  accomplish  flight  control  functions.  This 
classif icatlon  Includes  the  longitudinal,  lateral-directional,  lift,  drag  and 
variable  geometry  control  systems.  In  addition,  their  associated  augmenta- 
tion, perfomunce  limiting  and  control  devices  are  included. 


I 

1 

I 


8 


1.2. 1.2  \utowttc  flight  control  syafms  (AFCS)  . Automat lo  Flight  Control 
Systems  consist  of  electrical « mechanical  and  hydraulic  components  which 
generate  and  transmit  automatic  control  conmands  which  provide  pilot  assist- 
ance through  automatic  or  semiautomatic  flight  path  control  or  which  auto- 
nMtlcally  control  airframe  response  to  disturbances.  This  classlf Ic.at ii  a 
Includes  automatic  pilots,  stick  or  wheel  steering,  .lutothrottles , struc- 
tural mode  control  end  simller  control  mechanizations. 

DISCUSSION 

FCS  Claaslf Icat Ions  have  been  changed  from  the  Primary,  Secondary,  Auto- 
matic classifications  of  MIL-F-9490C  to  Manual  and  Automatic  FCS.  The  change 
from  Primary/ Secondary  FCS  to  Manual  FCS  wau  made  as  a result  of  a serious 
concern  with  the  high  parcantaga  (up  to  SO  percent)  of  recent  Air  Force 
incldent/accidant  reports  which  ate  due  to  secondary  flight  control  problems. 
To  reduce  the  number  of  problems  with  Secondary  Controls,  the  differentiation 
between  Primary/ Secondary  control  requirements  In  areas  such  as  failure 
Immunity  has  been  dropped  or  sharply  reduced. 

Stability  and  Command  Augmentation  are  included  under  Manual  Flight 
Controls  In  this  revision  due  to  the  Increasing  reliance  of  manual  controls 
on  augmentation.  Structural  Mode  Control  Is  Included  as  an  Automatic  FCS 
tunctlon,  with  emphasis  In  this  revision  on  ride  smoothing  and  fatigue 
alleviation.  Semiautomatic  control  Includes  flight  director  functions  when 
the  option  of  automatic  or  semiautomatic  operation  Is  provided. 

Systems  are  classified  as  Structure  Mode  Control  Systems  only  when  this 
classification  reflects  their  primary  function.  Most  Dutch  roll  dampers 
reduce  loads  and  improve  ride  in  turbulence,  although  this  is  not  their 
primary  function. 

1.2.2  FCS  Operational  State  classif Icatlons 

1.2. 2.1  Oparational  State  I (Normal  operation).  Operational  State  I is  the 
normal  state  of  flight  control  system  performance,  safety  and  reliability. 
This  state  satisfies  MIL-F-b785  or  MIL-F-83100  Level  1 flying  qualities 
requirements  within  the  operational  flight  envelope  and  Level  within  the 
service  envelope  and  the  stated  requirements  outside  of  those  envelopes. 

1.2. 2. 2 Operational  State  II  (Restricted  operation).  Operational  State  TI 
is  the  state  of  less  than  normal  equipment  operation  or  performance  which 
involves  degr.idatlon  or  failure  of  only  a noncritical  portion  of  the  overall 
flight  control  system.  A moderate  Increase  in  crew  workload  and  degradation 
in  mission  effectiveness  may  result  from  a limited  selection  or  normally 
operating  FCS  modes  available  for  use;  however,  the  intended  mission  may  be 
accomplished.  This  state  satisfies  at  least  MIL-b-d785  or  MIL-F-83300 
Level  2 flying  qualities  requirements  within  the  operational  flight  envelope 
and  Level  3 within  the  service  envelope. 

1.2. 2. 3 Operational  State  III  (minimum  safe  operation).  Operational  State 
III  is  the  state  of  dogriided  flight  control  systc  i performance,  safety  or 
reliability  wliich  permits  safe  termination  of  precision  tracking  or 
maneuvering  tasks,  and  safe  cruise,  descent,  and  landing  at  the  destination 
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of  original  intent  or  alternate  but  where  pilot  workload  la  excessive  or 
mission  effectiveness  is  Inadequate.  Phases  of  the  intended  mission 
involving  precision  tracking  or  maneuvering  cannot  be  completed  satis- 
factorily. This  state  satisfies  at  least  MIL-F-8785  or  MIL-F-83300  Level 
3 flying  qualities  requirements. 

1 . 2 . 2 . 4 Operational  State  IV  (controllable  tc  an  immediate  emergency 
landing) . Operational  State  IV  is  the  state  of  degraded  FCS  operation  at 
which  continued  safe  flight  is  not  possible;  however,  sufficient  control 
remains  to  allow  engine  restart  attempt  (s),  a contrriiled  descent  and 
immediate  emergency  landing. 

1.2. 2. 5 Operational  State  V (controllable  to  an  evacuable  flight 
condition) . Operational  State  V is  the  state  of  degraded  FCS  oneration  at 
which  the  FCS  capability  is  limite'’  to  maneuvers  required  to  reach  a flight 
condition  at  which  crew  evacuation  ..ay  be  Sc-fely  accomplished. 

DISCUSSION 

FCS  operational  state  classifications  define  a general  framework  about 
which  FCS  performance,  in  terms  of  FCS  operational  state,  can  be  related  to 
FCS  reliability  and  safety  requirements.  These  states  parallel  the  MIL-F- 
8785B  flying  qualities  Levels  1,  2 and  3.  For  example,  FCS  Operational 
State  I may  be  equated  with  Level  1 flying  qualities  within  the  normal 
flight  envelope.  However,  the  FCS  Operational  State  II  may  correspond  to 
either  Level  1 or  Level  2 flying  qualities.  FCS  Operational  State  II  may 
result  due  to  loss  of  a ride  smoothing  or  automatic  guidance  function,  for 
example,  while  Level  1 flying  qualities  are  maintained. 

A State  III  FCS  operational  level  may  be  reached  through  degradation  of 
any  flight  control  function  to  a state  which  requires  landing  at  the  nearest 
friendly  base.  A FCS  failure  mode  leading  to  Level  3 flying  qualities  will 
result  in  an  Operational  State  III  designation.  In  addition,  single  or 
multiple  channel  failures  resulting  in  a minimum  safe  configuration  in  a 
redundant  FCS  required  for  safety-of-f light,  mav  also  result  in  FCS  Opera- 
tional State  III  even  though  the  remaining  FCS  channel (s)  may  still  provide 
Level  1 flyivi'  qualities.  Note  that  in  some  cases  single  thread  mechanical 
controls  may  meet  reliability  requirements.  In  these  cases,  redundancy  is 
not  required  for  Level  1 operation. 

The  Operational  State  IV  classification  is  a new  concept  which  recog- 
nizes that  a level  of  FCS  performance  is  required  for  aircraft  such  as 
MIL-F-8785  Class  III  following  critical  failures  within  the  flight  controls, 
engines  or  other  systems  which  prohibit  continued  safe  flight.  The  intent 
of  this  classification  is  to  provide  for  those  FCS  minimum  requirements 
needed  to  escape  a hostile  a'  ja  or  flight  conditions  to  arrive  at  a safe 
evacuable  flight  condition. 

In  each  procurement  the  p.  ocuring  activity  will  specify  whether  State 
IV  or  State  V applies  (See  3.1.8). 


10 


1 2.3  FCS  crltiollty  classification 


1.2. 3.1  Essential.  A tunctlon  is  essential  if  loss  of  the  function  results 
in  an  unsafe  condition  or  inability  to  maintain  FCS  Operational  State  III. 

1.2. 3.2  Flight  phase  essential.  A function  is  flight  phase  essential  it 
loss  of  the  function  results  in  an  unsafe  condition  or  inability  to  maintain 
FCS  Operational  State  III  only  during  specific  flight  phases. 

1.2. 3. 3 Noncrltlcal . A function  is  nonciitlcal  if  loss  of  the  function  does 
not  affect  flight  safety  or  result  in  control  capability  below  that  required 
for  FCS  Operational  State  III. 

DISCUSSION 

Classifications  of  criticality  are  defined  around  which  system  ^nplemen- 
tatlon  requirements  can  be  organized.  MIL-F-9490C  assumed  that  all  Primary 
FCS  were  flight  essential  and  all  Secondary  FCS  were  noncrltlcal.  No  general 
criticality  distinction  ia  made  in  this  specification  among  the  FCS  classi- 
fications of  Manual  FCS  and  the  classifications  of  Automatic  FCS.  For  each 
procurement,  the  contractor  will  evaluate  the  criticality  of  each  flight 
control  function  based  on  the  mission  requirements  specified  by  the  procuring 
agency  and  design  approach  selected  by  the  contractor.  For  example,  in  a 
given  procurement  one  contractor  may  choose  to  utilize  an  airplane  configura- 
tion which  requires  an  essential  stability  augmentation  system,  while  a com- 
peting contractor  may  select  a different  airplane  configuration  which 
accomplishes  the  same  mission,  but  uses  a noucritlcal  stability  augmentation 
system. 
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2.0 


APPLICABLE  DOCUMENTS 


2.1  The  following  documents,  of  the  Issue  In  effect  on  thv%  date  of  invita- 
tion for  bids  or  request  for  proposal,  form  a part  of  this  specification  to 
the  extent  specified  herein.  The  lequirements  of  this  specification  shall 
govern  for  flight  control  system  design  where  conflicts  exist  between  this 
specification  and  other  referenced  specifications. 


SPECIFICATIONS 


Military 

MIL-T-781 

MIL-F-3541 

MIL-U-3963 

MIL-B-5087 

MIL-W-5088 

MIL-E-5400 

MIL-H-5440 

MIL-C-5503 

MIL-P-5518 

MIL-T-5522 

MIL-S-5676 

MIL-T-5677 

MIL-B-5687 

MIL-C-6021 

MIL-B-6038 

MIL-B-6039 

MIL-E-6051 

MIL-T-6117 

MIL-J-6193 

MIL-G-6641 

MIL-P-7034 

MIL-I-  7064 
MIL-E-7080 
MIL-F-7190 

MIL-D-7602 

MIL-B-7949 

MIL-C-7958 

MIL-M-7969 


Terminal,  Wire  Rope,  Swaging 
Fitting,  Lubrication 

Universal  Joint,  Antifriction  Bearings 

Bonding,  Electrical  and  Lightning  Protection,  fer 

Aerospace  Sysc  ms 

Wiring,  Aircraft,  Selection  and  Installation  of 
Electronic  Equipment,  Airborne,  General  Specification  for 
Hydraulic  Systems,  Aircraft  Types  I and  II,  Design, 
Installation,  and  Data  Requirements  for 
Cylinder,  Aeronautical,  Hydraulic  Actuating,  General 
Requirements  for 

Pneumatic  Systems,  Airciaft,  Design,  Ins'allation,  and 
Data  Requirements  for 

Test  Procedure  for  Aircraft  Hydraulic  and  Pneumatic 
Systems,  General 

Splicing  Cable  Terminal,  Process  for.  Aircraft 
Thimble,  Wire  Cable,  Aircraft 

Bearing,  Sleeve,  Washers,  Thrust,  Sintered,  Metal  Powder, 
Oil- Impr egna  ted 

Casting,  Classification  and  Inspection  of 
Bearing,  Ball,  Bellcrank,  Antifriction,  Airframe 
Bearing,  Double  Row,  Ball,  Sealed,  Rod  End,  Antifriction, 
Self-Aligning 

Electromagnetic  Compatibility  Requirements,  Systems 
Terminal,  Cable  Assemblies,  Swaged  Type 
Joint,  Universal,  Plain,  Light  and  Heavy  Duty 
Gearbox,  Aircraft  Accessory  Drive,  General  Specification 
for 

Pulley,  Groove,  Antifriction-Bearing,  Grease-Lubricated, 
Aircraft 

Indicator,  Position,  Elevator  Trim  Tab 

Electric  Equipment;  Aircraft,  Selection  and  Installation  cf 
Forging,  Steel,  for  Aircraft  and  Special  Ordnance 
Applications 

Drive,  Turbine,  Air,  Aircraft  Accessory,  General  Specifi- 
cation for 

Bearing,  Ball,  Airframe,  Antifriction 

Control,  Push-Pull,  Flexible  and  Rigid 

Motor,  AC,  400  Cycle,  115/200  Volt  System,  Aircraft, 

General  Specification  for 
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MIL-M-7997 

MIL-I-8500 

MIL-P-8564 

MIL-M-8609 

MIL-S-8698 

MIL-H-8775 

MIL-F-8785 

MIL-A-8860 

MIL-A-8861 

MIL-A-8865 

MIL-A-8866 

MIL-A-8867 

MIL-A-8870 

MIL-T-8878 

MIL-S-8879 

MIL-H-8890 

MIL-H-8891 

MIL-A-8892 

MIL-A-8893 

MIL-B-8976 

MIL-S-9419 

MIL-C-18375 

MIL-A-21180 

MIL-A-22771 

MIL-K-25049 

MIL-G-25561 

MIL-V-27162 

MIL-C-27500 

MIL-E-38453 


MIL-M-38510 

MIL-B-81820 

MIL-F-83142 

MIL-F-83300 

MIL-W-83420 

MIL-A-83444 


Motor,  Aircraft  Hydraulic,  Constant  Displacement,  General 
Specification  for 

Interchangeability  and  Replaceablllty  of  Component  Parts 
for  Aircraft  and  Missiles 

Pneumatic  System  Components,  Aeronautical,  General 
Specification  for 

Motor,  DC,  28  Volt  System,  Aircraft,  General  Specification 
for 

Structural  Design  Requirements,  Helicopters 

Hydraulic  System  Components,  Aircraft  and  Missiles,  General 

Specification  for 

Flying  Qualities  of  Piloted  Airplanes 

Airplane  Strength  and  Rigidity,  General  Specification  for 

Airplane  Strength  and  Rigidity,  Flight  Loads 

Airplane  Strength  and  Rigidity;  Miscellaneous  Loads 

Airplane  Strength  and  Rigidity  - Reliability  Requirements, 

Repeated  Loads,  and  Fatigue 

Airplane  Strength  and  Rigidity,  Ground  Tests 

Airplane  Strength  and  Rigidity  Flutter;  Divergence,  and 

Other  Aeroelastlc  Instabilities 

Turnbuckle,  Positive  Safetylng 

Screw  Threads,  Controlled  Radius  Root  with  Increased  Minor 
Diameter;  General  Specification  for 

Hydraulic  Components,  Type  III,  -65“  to  +450“F,  General 
Specification  for 

Hydraulic  Systems,  Manned  Flight  Vehicles,  Type  III,  Design, 
Installation,  and  Da«--  Requirements  for 
Airplane  Strength  xgidity,  Vibration 

Airplane  Strength  ana  Rigidity,  Sonic  Fatigue 
Bearing,  Plain,  Self-Aligning,  All-Metal 
Switch,  Toggle,  Momentary,  Four-Position  On,  Center  Off 
Cable,  Steel  (Corrosion-Resisting,  Nonmagnetic)  Flexible, 
Preformed  (for  Aeronautical  Use) 

Aluminum-Alloy  Casting,  High  Strength 
Aluminum  Alloy  Forgings,  Heat  Treated 
Knob,  Control,  Equipment,  Aircraft 
G-^ip  Assembly,  Controller,  Aircraft,  Type  MC-2 
Valve,  Servocontrol,  Electrohydraulic , General 
Specification  for 

Cable,  Electrical,  Shielded  and  Unshielded,  Aircraft 
and  Missile 

Environmental  Control,  Environmental  Protection,  and  Engine 
bxeed  Air  Systems,  Aircraft,  and  Aircraft  Launched  Missiles, 
General  Specification  for 
Microcircuit,  General  Specification  for 

Bearing,  Plain,  Self-Lubricating,  Self-Aligning,  Low  Speed 
Forging,  Titanium  Alloys,  for  Aircraft  and  Aerospace 
Applications 

Flying  Qualities  of  Piloted  V/STOL  Aircraft 
Wire  Rope,  Flexible,  for  Aircraft  Control 
Airplane  Damage  Tolerance  Requirements 
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STANDARDS 


Military 

MIL-STD-130 

MIL-STD-143 

MIL-STD-250 

MIL- STD-4 21 


MIL-STD-454 

MIL-STD-461 

MIL-STD-480 

MIL-STD-704 

MIL-STD-810 

MIL-STD-838 

MIL-STD-1472 

MIL-STD-1530 

MIL-STD-1553 

MS15002 

MS15981 

MS24665 

MS33540 

MS33572 

MS33588 

MS33602 

MS33736 

PUBLICATIONS 


Identification  Marking  of  U.S.  Military  Property 
Standards  and  Specifications,  Order  of  Precedence  for 
the  Selection  of 

Aircraft  Station  Controls  and  Displays  for  Rotary  Wing 
Aircraft 

Chain  Roller;  Power  Transmission  and  Conveyor,  Flat  Link 
Plates,  Single  Pitch,  Single  and  Multiple  Strand,  Con- 
nective Links  and  Attachment  Links 

Standard  General  Requirements  for  Electronic  Equipment 
Electromagnetic  Interference  Characteristics  Requirements 
for  Equipment 

Configuration  Control  - Engineering  Changes,  Deviations 
and  Waivers 

Electric  Power,  Aircraft,  Characteristics  and  Utilization 
of 

Environmental  Test  Methods 
Lubrication  of  Military  Equipment 

Human  Engineering  Design  Criteria  for  Military  Systems, 
Equipment  and  Facilities 

Aircraft  Structural  Integrity  Program,  Airplane  Require- 
ments 

Aircraft  Internal  Time  Division  Multiplex  Data  Bus 
Fittings,  Lubrication  (hydraulic)  Surface  Check,  Straight 
Threads,  Steel,  Type  II 

Fasteners,  Externally  Threaded,  Self-Locking,  Design  and 
Usage  Limitations  for 
Pin,  Cotter 

Safety  Wiring  and  Cotter  Pinning,  General  Practices  for 
Instrument,  Pilot,  Flight,  Basic,  Standard  Agreement  for 
Nuts,  Self-Locking,  Aircraft  Design  and  Usage  Limita- 
tions of 

Bolt,  Self  Retaining,  Aircraft  Reliability  and  Maintain- 
ability Design  and  Usage,  Requirements  for 
Turnbuckle  Assemblies,  Clip  Locking  of 


Military  Handbooks 

MIL-HDBK-5  Metallic  Materials  and  Elements  for  Aerospace  Vehicle 

Structures 

MIL-HDBK-17  Plastics  for  Flight  Vehicles 

Air  Force  Systems  Command  Design  Handbooks 

AFSC  DH  1-2  General  Design  Factors 

AFSC  DH  1-4  Electromagnetic  Compatibility 

AFSC  DH  1-5  Environmental  Engineering 
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AFSC  DH  1-6  System  Safety 

AFSC  DH  2-1  Airframe 

AFSC  DH  2-2  Crew  Stations  and  Passenger  Accommodations 

(Copies  of  specifications,  standards,  drawings,  publications  and  handbooks 
required  by  suppliers  In  connection  with  specific  procurement  functions 
should  be  obtained  from  the  procuring  activity  or  as  directed  by  the  con- 
tracting officer.) 

2.2  Other  Publications.  The  following  documents  form  a part  of  this  speci- 
fication to  the  extent  specified  herein.  Unless  otherwise  Indicated,  the 
Issue  in  effect  on  date  of  invitation  for  bids  or  request  for  proposal  shall 
apply. 

National  Aircraft  Standard 

NAS  516  Fitting,  Lubrication  - 1/8  Inch  Drive,  Flush  Type 

(Copies  of  National  Aircraft  Standards  may  be  obtained  from  the  Aircraft 
Industries  Association  of  America,  Inc.,  Shoreham  Building,  Washington, 

D.  C.) 

SAE  Aerospace  Recommended  Practices 

ARP  988  Electrohydraulic  Mechanical  Feedback  Servoactuators 

ARP  1281  Servoactuators:  Aircraft  Flight  Controls,  Power 

Operated,  Hydraulic,  General  Specification  for 

(Application  for  copies  should  be  addressed  to  the  American  Society  of 
Automotive  Engineers,  Two  Pennsylvania  Plaza,  New  York,  New  York  10001.) 

ICAO  Practices 


ICAO  Annex  10  International  Civil  Aviation  Organization  Publication  - 
Aeronautical  Telecommunications  Vol.  II,  Communication 
Procedures,  International  Standards,  Recommended  Prac- 
tices and  Procedures  for  Air  Navigation  Services 

FAA  Advisory  Circular 

FAA  Advisory  Criteria  for  Approving  Category  I and  Category  II  Land- 

Circular  120-29  ing  Minima  for  FAR  121  Operators 

Technical  Reports 

AFFDL-TR-74-116  Background  Information  and  User  Guide  for  MIL-F-9490D 

(Technical  society  and  technical  association  specifications  and  standards 
are  generally  available  for  reference  from  libraries.  They  are  also  dis- 
tributed among  technical  groups  and  using  Federal  agencies. 
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3.0  REQUIREMENTS 


3.1  System  requirements.  The  FCS  shall  comply  with  the  following  require- 
ments. 

DISCUSSION 

The  following  sections  specify  general  requirements  for  flight  control 
systems.  Additional  detail  system  requirements  and  the  aerodynamic  and 
flight  configurations,  external  stores  configurations,  and  aircraft  per- 
formance range  through  which  the  flight  control  system  will  be  required  to 
satisfy  these  requirements  shall  be  as  defined  in  the  procurement  detail 
specification.  Paragraph  3.2  defines  subsystem  and  component  requirements 
and  3.3  defines  special  flight  control  system  requirements  for  rotary  wing 
aircraft. 

This  section  specifies  system  requirements  in  terms  of  performance  and 
design  requirements.  This  specification  does  not  place  priorities  on  either 
performance  or  design  requirements,  considering  all  requirements  to  be  of 
equal  Importance.  Performance  requirements  specify  what  the  system  must 
provide  or  do.  Design  requirements  constrain  the  system  design  to  Insure 
that  system  operation  will  be  acceptable  in  service.  The  reader  should  be 
fully  aware  that  system  development  must  Include  consideration  of  costs, 
maintenance,  complexity,  and  safety,  as  well  as  performance.  Procuring 
activity  desires  or  requirements  may  be  often  in  conflict  in  two  or  more  of 
these  asset/liability  areas.  The  contractor  is  expected  to  perform  trade 
studies  to  evaluate  tradeoffs  involved.  Data  from  these  trade  studies  will 
normally  be  required  to  obtain  deviations,  as  noted  in  6.2. 

3.1.1  MFCS  Performance  requirements.  The  MFCS  shall  comply  with  applicable 
general  flying  quality  requirements  of  MIL-F-8785  or  MIL-F-83300  and  the 
special  performance  requirements  of  the  procurement  detail  specification. 

DISCUSSION 

The  sources  for  Manual  FCS  performance  requirements  are  MIL-F-8785,  MIL- 
F-83300  and  the  procurement  detailed  specification.  This  specification 
defines  design  requirements  for  all  FCS  and  performance  requirements  for 
Automatic  FCS.  Reference  1 provides  background  and  user  information  support- 
ing MIL-F-8785B. 

Research  has  been  pursued  in  recent  years  to  identify  analytical  proce- 
dures and  techniques  which  provide  an  organized  approach  to  satisfying  Manual 
FCS  performance  requirements.  The  weapons  delivery  requirements  of  indi- 
vidual procurements  can  often  be  best  approached  through  a paper  pilot 
(Reference  2)  or  simulation  approach.  Reference  3 documents  a series  of  Air 
Force  studies  on  piloted  weapon  delivery  which  T^ay  be  helpful  in  procurements 
where  strafing,  dive  bombing,  or  aerial  gunnery  is  a mission  requirement. 
Reference  4 documents  a similar  study  considering  higher  order  controls 
system  dynamics.  Reference  5 discusses  multimode  flight  control  for  preci- 
sion weapon  delivery  and  concludes  that  a control  system  specifically 
designed  for  gunnery  is  superior  to  a connventlonal  SAS  for  weapons  delivery 
purposes.  Reference  6 documents  a study  to  develop  improved  design  criteria 
for  command  augmentation.  The  study  consisted  of  eight  parts,  Including  a 
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survey  of  operational  prcblems,  a review  of  system-gain  changing  requlretaencs 
and  techniques,  stablllxatlon  criteria  for  frequency  modes,  an  analysis  of 
stall-spin  isaneuvers,  an  analysis  of  system/airframe  compatibility  testing, 
definition  of  criteria  for  bullt-ln-test  equipment,  and  catalogs  of  flight 
control  actuator  designs  and  of  dominant  performance  characteristics  ^-rhlch 
affect  flying  qualities. 

References  7 and  8 document  a flight  test  evaluation  of  a high  gain 
CAS  In  an  F-A.  One  conclusion  of  this  flight  test  was  that  MIL-F-8785B 
(ASG)  does  not  prop'irly  address  the  requirements  for  a stable,  controllable 
platform  for  accomf llshlng  a tracking  task.  Reference  9 Is  an  Interesting 
study  titled  "Outsmarting  MIL-F-8785B  (ASG),  The  Military  Flying  Qualities 
Specification."  Tills  study  points  out  some  of  the  weaknesses  of  MTL-F-8785B 
and  may  eld  the  controls  designer  in  understanding  his  complex  task.  Ref- 
erence 10  describes  the  benefits  of  a Stall  Inhibitor  System  developed  for 
the  F-111. 

Reference  11  documents  a survey  of  classical  and  modern  control  analy- 
sis methods  for  FCS  design.  This  reference  points  cut  that  a very  large 
amount  of  published  material  exists  relating  to  the  design  of  flight  control 
sy  ‘^ems.  Many  methods  are  available  for  synthesis  of  controllers,  ranging 
fr  m classical  cut-and-try  methods  to  optimal  techniques.  Within  the 

dustry  control  designers  are  making  use  of  a spectrum  of  these  techniques, 

..  jAther  with  a fair  amount  of  Intuition,  simulation,  and  hard  work,  to 
generate  workable  designs.  No  one  technique  has  been  shown  to  produce 
consistently  superior  designs. 

An  important  conclusion  of  Reference  11  is  that;:  "There  does  not  exist 

any  method  or  combination  of  methods  which  will  permit  a person  not  experi- 
enced In  control  to  generate  a workable  design." 

Numerous  "good  practices"  are  recommended  ^n  these  references  which 
are  based  on  specific  experience  with  Individual  airplanes  or  groups  of 
airplanes.  Due  to  the  unique  demands  of  Individual  procurements,  most  of 
these  recommendations  are  not  Incorporated  In  this  specification  as  require- 
ments. However,  for  emphasis,  the  following  reconnended  practices  are 
listed  for  consideration. 

Selectable  command  modes.  Pilots  will  select  and  adapt  to  special 
augmentation  modes  during  weapons  delivery  and  other  special  flight  phases 
where  special  mission  task  requirements  conflict  with  normal  flying  quali- 
ties. The  contractor  should  consider  selectable  command  modes,  where  per- 
tinent. But  Inconsistencies  in  display  Indications  or  the  result  of  cockpit 
control  motions  can  be  confusing  to  the  pilot.  For  example,  reversals  of 
eenrse  ’^ust  be  avoided. 

Stabilization  axis.  In  control  system  designs  in  which  the  pilots 
lateral  controller  operates  both  ailerons  and  rudder  or  their  equivalent, 
consideration  should  be  given  to  the  resultant  effective  axis  of  rotation. 

If  one  of  the  prime  weapons  of  the  vehicle  is  a fixed  body  mounted  gun, 
the  preferred  effective  axis  of  rotation  should  be  coincident  with  the  gun 
axis,  which  itself  should  be  aligned  along  a stability  axis  defined  by  the 
anticipated  angle-of-attack  In  firing  mode.  If  the  gun  axis  differs  con- 
siderably from  a stability  axis  at  delivery,  rotation  about  the  gun  axis 
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will  cause  angle-of**attack  to  translate  into  sideslip,  possibly  of 
unacceptable  amounts,  and  in  this  event  the  preferred  axis  should  be 
between  the  gun  and  stability  axes  at  a point  at  which  sideslip  in  normal 
firing  maneuvers  is  maintained  at  a satisfactorily  small  value.  These 
considerations  may  conflict  with  the  need  to  keep  lateral  acceleration  in 
bounds  at  the  cockpit. 

Direct  flight  path  control.  Control  systems  for  vehicles  having  pure 
sldeforce  generators  should  be  designed  bearing  in  mind  the  possible  improve- 
ments in  weapon  delivery  accuracy  achievable  by  unconventional  response  to 
pilot  controls.  Control  systems  combining  direct  lift  and  sldeforce  gener- 
ators, decoupling  feedback  and  feed  forward,  and  possibly  a controller  in 
addition  to  the  usual  stick  and  pedals  may  be  used  if  expected  Improvements 
in  weapon  delivery  accuracy  can  be  demonstrated  analytically  or  by  simula- 
tion to  the  satisfaction  of  the  procuring  agency.  Consideration  should  be 
given  to  control  schemes  in  which  the  pedals  or  a separate  controller  give 
direct  lateral  flight  path  control  with  zero  bank  or  sideslip  and  in  which 
a column  cr  a separate  controller  produces  vertical  flight  path  control  with 
zero  or  small  pitch  change.  The  pilot's  ability  to  handle  an  additional 
control,  of  course,  is  a factor. 

Gust  and  external  disturbance  response.  Designs  where  specific  meas- 
ures are  taken  to  Improve  the  gust  and  external  disturbance  response  of  the 
aircraft  are  recommended.  The  maintenance  of  ground  track  despite  turbulence 
is  of  particular  importance  when  high,  level  bombing  is  the  probable  vehicle 
mission.  Designs  incorporating  the  decoupling  of  sideslip  from  lateral  con- 
trol and  bank  angle  from  directional  control  should  be  examined  particularly 
carefully  with  respect  to  the  bank  angles  generated  by  side  gusts.  Decoup- 
ling techniques  in  current  use  can  cause  deterioration  in  gust  response  if 
attention  is  not  given  specifically  to  preventing  the  deterioration. 

Limit  cycles  during  weapons  delivery.  Adaptive  or  other  automatic  gain 
changing  systems  relying  on  limit  cycle  detection  for  gain  changing  deci- 
sions should  be  designed  paying  particular  attention  to  the  avoidance  of 
the  limit  cycle  during  flight  conditions  at  which  weapons  will  be  delivered. 
i;ie  limit  cycle  should  be  undetectable  to  the  pilot.  Similarly,  if  system 
gain  changing  takes  place  during  weapon  delivery,  while  the  servos  are 
moving,  no  thumping  sensations  should  be  experienced  by  the  pilot  and  fly- 
ing qualities  must  remain  satisfactory  throughout,  despite  the  gain  changes. 

Trim  changes.  Apparent  trim  changes  originating  in  the  augmentation 
or  control  systems  should  be  avoided  whether  due  to  extended  low  frequency 
response  in  the  systems  or  to  a normal  accelerometer  sensing  less  than  Ig 
in  a climb  or  dive.  An  automatic  trim  system  reducing  these  apparent  trim 
changes  to  below  pilot  threshold  will  normally  be  acceptable.  Where  there 
are  directional  trim  changes  with  speed  change  during  a weapon  delivery  run, 
systems  designed  to  minimize  the  trim  change  are  desirable. 

Constant  stick  forces.  Systems  Incorporating  washout  filters  on  sen- 
sor outputs  or  elsewhere  in  the  system  should  be  designed  to  avoid  changes 
in  stick  force  with  time  during  sustained  constant  normal-acceleration  turns. 
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Symmetrical  stick  forcaa.  Control  eyetema  incorporating  models  should 
be  designed  to  provide  Identical  sensitivity  for  nose^ovn  and  nose-up 
commands.  Whatever  the  system  design,  the  stick  forces  for  a given  magni- 
tude response  should  be  the  name  irrespective  of  the  sign  of  the  conssand. 
This  applies  both  laterally  and  longitudinally. 

Aircraft  flexibility.  There  can  be  effects  beyond  the  impact  of  aero- 
elastlclty  on  aircraft  handling  and  flight  control  systems.  For  example, 
the  design  of  a control-augmentation  system  to  be  used  in  pert  for  weapon 
delivery  must  address  itself  to  the  effects  of  aircraft  flexibility  on 
weapon  delivery  accuracy.  A reduction  in  amplitude  of  flexible  body 
oscillation  may  be  necessary  to  reduce  oscillatory  boreslght  errors. 

Static  boreslght  errors  due  to  loading  in  high-g  maneuvers  should  also  be 
considered  in  estimating  delivery  accuracy  degradation  due  to  flexibility. 

Hysteresis . Hysteresis  or  backlash  at  any  point  in  the  control- 
augmentation  system  should  be  controlled  either  by  antibacklash  springs  or 
by  other  means,  at  least  to  the  point  that  limit  cycles  existing  anywhere 
are  imperceptible  to  the  pilot  at  any  flight  condition  at  which  weapons  oiay 
be  delivered. 

Gun  moments.  The  effect  of  firing  high  repetition  rate  small  caliber 
weapons  or  large  projectiles  from  the  aircraft  on  the  stability  of  the 
vehicle  should  be  understood  and  compensated  for  in  the  control  system 
design. 

Growth  capability.  A candiaate  system  concept  should  be  carefully 
examined  for  growth  capability  before  selection  for  design  and  development. 
Reference  13  documents  how  the  complexity  of  a system  can  escalate  as 
knowledge  of  aircraft  dynamic  characteristics  are  refined  and  the  detail 
problems  of  designing  flight-critical  controls  become  known. 

3.1.2  AFCS  Performance  requirements.  When  the  following  AFCS  functions 
are  use.  . the  following  specified  performance  shall  be  provided.  Unless 
otherwise  specified,  these  requirements  apply  in  smooth  air  and  include 
sensor  error.  Except  where  otherwise  specified,  a damping  ratio  (6.6)  of 
at  least  0.3  critical  shall  be  provided  for  nonstructural  AFCS  controlled 
mode  responses.  Specified  damping  requirements  apply  only  to  the  response 
characteristics  for  perturbations  an  order  of  magnitude  greater  than  the 
allowable  residual  oscillation. 

DISCUSSION 

The  AFCS  performance  specified  in  this  Section  is  intended  to  include 
"not-to-exceed"  parameters  which  are  felt  necessary  for  proper  fleet  oper- 
ation. Pilot  relief  functions  are  specified  to  reduce  crew  fatigue  to  a 
level  consistent  with  mission  requirements.  Automatic  landing  and  terrain 
following  are  specified  to  extend  mission  capabilities  in  applications 
where  the  mission  warrants  the  additional  complexity.  Performance  is 
generally  specified  with  respect  to  sensor  indicated  values.  In  many  cases, 
sensor  accuracy  is  set  by  manual  control  considerations.  Where  performance 
is  not  specified  with  respect  to  an  FCS  sensor  reference,  sensor  error  must 
be  included  in  meeting  the  requirement. 
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The  concept  of  specifying  performance  to  Include  sensor  error  may 
lead  to  deviation  requests  where  sensors  are  government  furnished  and  do 
not  permit  meeting  the  stated  performance.  Where  sensors  are  government 
furnished,  the  procuring  activity  must  accept  the  responsibility  for 
providing  sensors  of  adequate  accuracy. 

3.1. 2.1  Attitude  hold  (pitch  and  roll).  Attitudes  shall  be  maintained  in 
smooth  air  with  a static  accuracy  of  ^.5  degree  in  pitch  attitude  (with 
wings  level)  and  +1.0  degree  in  coll  attitude  with  respect  to  the  reference. 

RMS  attitude  deviations  shall  not  exceed  5 degrees  In  pitch  or  10  degrees  In 
roll  attitude  In  turbulence  at  the  Intensities  specified  in  3, 1.3. 7.  When 
using  a flight  controller  (turn  knob)  the  aircraft  shall  return  to  a wings 
level  attitude  when  the  turn  control  Is  placed  In  the  detent  position. 

Accuracy  requirements  shall  be  achieved  and  maintained  within  3 seconds  of 
mode  engagement  for  a 5 degree  attitude  disturbance  for  MIL-F-8785  Class  IV 
aircraft,  and  within  5 seconds  for  MIL-F'*8785  Classes  I,  II  and  III  aircraft. 

3. 1.2. 2 Heading  hold.  In  smooth  air,  heading  shall  be  maintainsd  within  a 
static  accuracy  of  +0.5  degree  with  respect  to  the  reference.  In  turbulence, 

RMS  deviations  shall  not  exceed  5 degrees  in  heading  at  the  Intensities 
specified  in  3.1. 3.7.  When  using  a flight  controller,  heading  hold  shall 
automatically  engage  as  the  controller  Is  returned  to  the  detent  position. 

3. 1.2. 3 Heading  select.  The  aircraft  shall  autooMtlcally  turn  through  the 
smallest  angle  to  any  heading  selected  or  preselected  by  the  pilot  and  main- 
tain that  heading  to  the  tolerances  specified  for  heading  hold.  The  con- 
tractor shall  determine  a bank  angle  limit  which  provides  a satisfactory 
turn  rate  and  precludes  Impending  stall.  The  heading  selector  shall  have 
360  degrees  control.  The  aircraft  shall  not  overshoot  the  selected  heading 
by  more  than  1.5  degrees  with  flaps  up  or  2.5  degrees  with  flaps  down.  The 
roll  rate  shall  not  exceed  10  deg/sec  and  roll  acceleration  shall  not  exceed 
5 deg/sec/sec  for  MlL-F-8785  Classes  I,  II  and  III  aircraft,  or  double  these 
values  for  MIL-F-8785  Class  IV  aircraft. 

DISCUSSION 

Attitude  hold  maneuver  limits  are  not  Included  in  this  general  require- 
ment due  to  the  lack  ot  agreement  on  maneuver  limits.  MIL-F-9490C  set 
maneuver  limits  for  the  attitude  hold  function  +60  degrees  in  roll,  +15 

degrees  in  pitch,  and  +7  degrees  yaw  angle  for  control  stick  steering  appli-  j 

cations.  Maneuver  limits  will  normally  be  specified  in  the  detailed  sped-  i 

t icatlon  or  will  be  established  by  the  contractor  for  each  procurement  based  i 

on  requirements  of  that  proourement.  j 

The  accuracy  requirement  ot  j^.5  degrees  for  attitude  hold  modes  repre- 
sents a typical  air  transport  requirement,  Reference  13,  and  state-of-the-art 
capability.  The  accuracy  requirement  in  turbulence  applies  only  up  to  the 
turbulence  amplitude  limits  specified  herein.  Attitude  hold  and  other  pilot 
as.sist  AFCS  modes  will  normally  be  classified  as  noncrltlcal  functions  and, 
as  such,  the  turbulence  lequlreraent  stated  will  normally  apply  only  in 
light  turbulence. 
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The  10  degraes  bank,  5 dagracs  pitch  angla  and  the  3 dagrees  heading 
limit  in  turbulence  la  Intended  to  provide  the  pilot  vlth  a reasonably 
stable  platform  during  flight  In  the  turbulence  environment  to  which  the 
attitude  and  heading  hold  loops  will  be  designed.  A system  which  Is  easily 
saturated  In  turbulence  will  have  trouble  meeting  these  requirements,  and 
should  be  avoided. 

The  heading  hold  static  accuracy  requirement  of  0.3  degree  reflects 
the  current  state-of'-the''art . Reference  13  states  typical  air  transport 
heading  hold  requirements,  which  may  be  considered  In  pertinent  applications, 
as  follows:  when  selection  of  this  mode  Is  made  while  the  aircraft  Is  turn- 

ing, the  airplane  should  return  to  wlngs-level  at  a roll  rate  not  to  exceed 
6.0  deg/sec,  a roll  acceleration  not  to  exceed  3.0  deg/sec/sec,  and  should 
hold  the  heading  that  exists  at  the  time  the  airplane  Is  within  approximately 
3 degrees  of  wings  level. 

The  bank  angle  limit  for  Heading  Selec  t,  to  be  determined  by  the  con- 
tractor, will  probably  be  unique  for  each  new  procuremsnt.  The  requirement 
Co  preclude  Impending  stall  is  meant  to  apply  with  normal  power  settings. 

This  pilot  relief  mode  la  not  expected  to  normally  result  In  steep  banks  or 
operation  near  stall. 

3. 1.2.4  Lateral  acceleration  and  sideslip  limits.  Except  for  flight  phases 
using  direct  side  force  control,  the  following  performance  shall  be  provided 
whenever  any  lateral-directional  AFCS  function  Is  engaged.  Lateral  accelera- 
tion refers  to  apparent  (measured,  sensed)  body  axis  acceleration  at  the 
aircraft  center  of  gravity, 

3. 1.2. 4.1  Coordination  in  steady  banked  turns.  Sideslip  angle  shall  not  be 
greater  than  2 degrees  and  lateral  acceleration  shall  not  exceed  0.03g,  while 
at  steady  bank  angles  up  to  the  maneuver  bank  angle  limit  reached  during 
norisal  maneuvers  with  the  AFCS  engaged.  For  rotary  wing  aircraft,  only  the 
lateral  acceleration  limit  applies. 

3. 1.2. 4. 2 Lateral  acceleration  limits,  rolling.  Body  axis  lateral  accelera- 
tion at  the  eg  shall  not  exceed  j<).lg  for  aircraft  with  roll  rate  capability 
up  to  30  deg/sec,  jK^.2g  for  aircraft  with  roll  rate  capebility  of  30  to  90 
deg/sec,  or  ;W.3g  for  .aircraft  with  roll  rates  over  90  deg/sec.  These  limits 
shall  be  satisfied  for  aircraft  In  essentially  constant  altitude  flight  while 
rolling  smoothly  from  one  side  to  the  other  at  bank  rates  up  to  the  maximum 
obtal.table  through  AFCS  modes. 

3. 1.2. 4. 3 Coordination  In  straight  and  level  flight.  The  accuracy  while  the 
aircraft  Is  In  straight  and  level  flight  shall  be  maintained  wl..hin  a side- 
slip angle  of  +1  degree  and  a lateral  acceleration  of  j^.02g  at  the  eg, 
whichever  is  lower.  For  rotary  wing  aircraft,  only  the  lateral  acceleration 
limit  applies. 

3. 1.2. 5 Altitude  hold.  Engagement  of  the  altitude  hold  function  at  rates  of 
climb  or  de‘-.cenc  less  than  2000  fpm  shall  select  the  existing  indicated 
barometric  altitude  and  control  the  aircraft  to  this  altitude  as  a reference. 
The  resulting  normal  acceleration  shall  not  exceed  0.2g  incremental  for 
MIL-F-8785  Classes  I,  II  and  III  aircraft,  or  0.3g  Incremental  for  MlL-F-8785 
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rias<  IV  ilrrrr.lt.  For  engagtiMnc  at  rates  above  2000  feet  per  alnute  the 
Al'c:s  sliaU  not  reuse  any  unsafe  maneuvers.  Within  the  aircraft  thrust-drag 
cap.iMllty  and  at  steady  bank  angles,  the  node  shall  provide  control  accur- 

ark-a  shown  in  Table  I. 


TABl  F I MINIMUM  ACTEFl  ABLE  CX)NTROL  ACCURACY 


..jiAJ^  ANGLE  (DEG.) 
AlX(Ff!T^ — 

0-  1 

1 -30 

30-60 

55,000 

±0.19f^  at  55.000 

to 

varying  linearly 

80.000 

to  ±0.2%  at  80,000 

±b0  ft. 

±90  ft. 

30.000 

or 

or 

to 

±0.l'r 

±0.3% 

±0.4% 

55.000 

whichever 

whichever 

is 

is 

brgrr 

larger 

0 

to 

±30  ft. 

30,000 

These  accuracy  requirements  apply  for  airspeeds  up  to  Mach  1.0.  Double  these 
values  are  permitted  above  Mach  1.0  and  triple  these  values  apply  above  Mach 
2.0.  Following  engagement  or  perturbation  of  this  mode  at  2000  feet  per  min- 
ute or  less,  the  specified  accuracy  shall  be  achieved  within  30  seconds.  Any 
periodic  residual  oscillation  within  these  limits  shall  have  a period  of  at 
least  20  seconds. 

3. 1.2.6  Mach  hold.  The  Mach  number  existing  at  the  engagement  of  Mach  hold 
shall  be  the  reference.  After  engagement  and  stabilization  on  Mach  hold, 
the  AFCS  shall  maintain  indicated  Mach  number  and  the  error  shall  not  exceed 
>9.01  Mach  or  +2  percent  of  indicated  Mach,  whichever  is  larger,  with  respect 
to  the  reference.  Any  periodic  oscillation  within  these  limits  shall  have 

a period  of  at  least  20  seconds.  The  contractor  shall  establish  a mode 
response  or  maximum  time  to  capture  requirement  which  is  suitable  for  the 
mission  phase. 

3.1.2. 7 Airspeed  hold.  The  airspeed  existing  at  the  engagement  of  airspeed 
hold  shall  be  the  reference.  Indicated  airspeed  shall  be  maintained  within 
+ knots  or  >2  percent,  whichever  is  greater,  of  the  reference  airspeed.  Any 
periodic  oscillation  within  this  limit  shall  have  a period  of  at  least  20 
seconds.  The  contractor  shall  ercsblish  a mode  response  or  maximum  time 

to  capture  requirement  which  is  suitable  for  the  mission  phase. 
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Altitude  hold  requirements  Include  acceleration  amplitude  limits.  For 
relerence,  commercial  transports  normally  limit  normal  acceleration  for 
altitude  hold  engagement  to  0.15g  Incremental.  Residual  osclllatlcnts  are 
permitted  within  the  amplitude  limits  specified  herein.  Response  require- 
ments are  specified  similar  to  those  used  ir.  a recent  commercial  transport 
AFCS  development  and  In  a recent  USAF  fighter  AFCS  development. 

Provisions  should  normally  be  Included  to  disengage  altitude  hold  at 
a given  angle  of  attack.  The  F-111,  for  example,  can  get  in  a situation 
where  more  thrust  is  required  than  Is  available  and  the  altitude  hold 
feature  will  continue  to  Increase  angle  of  attack  until  stall. 

In  addition  to  the  altitude  hold  accuracies  specified  for  steady  bank 
angles,  performance  in  maneuvering  flight  should  also  be  considered  by  the 
designer.  Also  the  designer  should  not  overlook  the  need  to  control  alti- 
tude excursions  during  airspeed  changes.  Altitude  hold  deviations  during 
normal  airplane  configuration  changes  should  also  be  considered. 

Airspeed  hold  requirements  are  specified  wl)ich  are  similar  to  those 
used  In  commercial  applications.  Minimum  damping  is  specified  in  3.1.2  for 
the  transient  response  following  a disturbance;  however,  there  is  no  damping 
requirement  for  small  oscillations  within  the  performance  tolerance  bands. 

The  contractor  is  required  to  establish  a maximum  time  for  recapture  of  the 
commanded  airspeed  or  Mach  following  a disturbance  which  is  suitable  for  the 
mission  phase.  This  value  will  be  bused  on  the  control  characteristics  of 
the  individual  aircraft  being  doveloped  and  should  be  included  in  the  FCP 
Specification  (4.4.2). 

Altitude  hold  and  airspeed  hold  tolerance  increase  with  airspeed. 
yF-12  experience  has  shown  that  tolerances  may  need  to  be  relaxed  for  flight 
rear  Mach  3.0.  Otherwise,  the  tight  loops  needed  i.o  hold  Mach  may  result  in 
large  altitude  variations  and  degraded  ride  qualities. 

The  sideslip  angle  limits  specified  herein  are  not  applicable  for  heli- 
copters. Helicopters  normally  fly  at  varying  small  sideslip  angles  in 
trimmed  level  flight  with  zero  lateral  acceleration  because  of  the  variation 
of  the  Inpli ne  rotor  forces  as  a function  of  flight  condition. 

3. 1.2. 8 Auto  atic  navigation. 

3. 1.2. 8.1  VOR/ TACAN.  When  preconditions  for  radial  capture  are  satisfied 
the  AFCS  shall  cause  the  aircraft  to  maneuver  to  acquire  the  radial  beam 
center.  Maximum  roll  rate  and  attitude  commands  shall  be  limited  to  provide 
a smooth  capture  and  subsequent  tracking  of  the  radial.  The  following  per- 
formance requirements  for  VOR  are  stated  in  terms  of  crosstrack  error  (teet) 
and  radial  error  (expressed  in  amps;  1 degree  «■  15  amps)  to  provide  for 
systems  using  either  ARINC  547  or  579  VOR  receivers.  For  ARINC  547 
receivers  only  the  radial  error  applies.  Crosstrack  error  applied  to  the 
ARINC  579  receiver  operating  in  the  primary  mode  (co-located  VOR/PME) , and 
radial  error  apolles  in  the  reversionary  mode  (DME  inoperative  oi  not  avail- 
able) . 
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3. 1.2. 8. 1.1  VOR  capture  and  tracking.  Overshoot  shall  not  exceed  5,800 
feet  (20  t)  a)  beyond  the  desired  ground  track  line  in  a no-wind  condition 
for  captures  30  miles  or  more  from  the  station  with  intercept  angles  up  to 
45  degrees.  Following  capture  at  50  miles  or  more,  the  aircraft  shall 
remain  within  an  average  of  5,800  feet  (20  a)  from  the  VOR  radial  beam 
center,  with  this  error  allowance  decreasing  proportional  to  the  distance 
from  the  VOR  station.  Average  tracking  error  shall  be  measured  over  a 5 
minute  period  between  50  and  10  miles  from  the  station  or  averaged  over  the 
nominal  aircraft  flight  time  between  the  same  distance  limits,  whichever 
time  is  shorter. 

3. 1.2. 8. 1.2  TACAN  capture  and  tracking.  Overshoot  shall  not  exceed  6,300 
feet  beyond  the  desired  ground  track  line  in  a no-wind  condition  for  captures 
120  miles  or  more  from  the  station  with  intercept  angles  up  to  30  degrees. 

The  required  0.3  damping  ratio  shall  be  exhibited  for  continuous  tracking 
between  120  miles  and  20  miles  from  the  station. 

3. 1.2. 8. 1.3  Overstation.  The  VOR/TACAN  mode  shall  include  automatic  means 
for  maintaining  the  aircraft  within  +1  degree  of  aircraft  heading  or  ground 
track  existing  at  the  inbound  edge  of  the  VOR  zone  of  confusion  (ZOC) . Dur- 
ing overflight  of  the  ZOC,  adjustment  of  the  preset  course  heading  or  its 
equivalent  shall  cause  the  roll  AFCS  to  maneuver  the  aircraft  to  capture  the 
appropriate  outbound  radial  upon  exiting  from  the  ZOC.  The  VOR/TACAN  capture 
maneuvering  limits  may  be  reinstated  during  overstation  operation. 

3. 1.2. 9 Automatic  instrument  low  approach  system.  The  approach  mode  of  the 
AFCS  shall  respond  to  localizer  signals  for  lateral  guidance  and  glide  slope 
signals  for  vertical  guidance.  The  system  shall  be  designed  to  automatically 
steer  the  aircraft  to  a minimum  decision  height  of  100  feet  during  ICAO 
Category  II  weather  minimums.  The  system  shall  provide  timely  warning  to  per- 
mit the  pilot  to  complete  the  landing  if  runway  visual  coi tact  is  established 
or  to  safely  execute  a go-around  following  any  single  failure  or  combination 
of  failures  not  shown  to  be  extremely  remote  as  defined  in  6.6.  The  system 
shall  comply  with  the  tracking  requirements  of  3. 1.2. 9.1  through  3. 1.2. 9. 3 
for  probable  combinations  of  headwinds  to  25  knots,  tailwinds  to  10  knots, 
and  crosswinds  to  15  knots,  with  the  probability  of  occurrence  of  such  winds 
and  associated  turbulence  and  wind  shears  as  defined  In  3. 1.3. 7. 3. 

3. 1.2. 9.1  Localizer  mode.  The  AFCS  shall  cause  the  aircraft  to  maneuver  to 
acquire  the  localizer  beam.  Heading  or  roll  rate  and  attitude  commands  shall 
be  limited  to  provide  a smooch  capture  and  subsequent  tracking  of  the  local- 
izer beam.  Overshoot  shall  not  exceed  0.5  degrees  (37.5  ^ a)  radial  error 
from  localizer  beam  center  for  captures  with  Initial  intercept  angles  of  45 
degrees  at  8 miles  from  runway  threshold  and  increasing  linearly  to  60 
degrees  at  18  miles  from  runway  threshold  in  a no  wind  condition.  During 
localizer  capture  the  system  shall  exhibit  a damping  ratio  of  at  least  O.i 
within  the  noted  capture  ranges,  including  the  effects  of  system  nonlinear- 
ities. The  system  shall  be  considered  to  be  tracking  whenever  the  following 
conditions  are  satisfied:  localizer  beam  error  is  1 degree  (75  H a)  or  less, 

localizer  beam  rate  is  0.025  deg/sec  (2  f4  a/sec)  or  less,  and  roll  attitude 
is  5 degrees  or  lass.  During  beam  tracking  the  sy&*-em  shall  exhibit  a damp- 
ing ratio  of  0.2  or  greater  at  a distance  of  40,000  feet  from  the  localizer 
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transmltt^ir . The  AFCS  shall  oaintaln  the  aircrait  2 <r*  position  within  0.33 
degrees  (25  a)  of  localizer  beam  center  whenever  the  aircraft  is  between 

(1)  40,000  feet  horizontal  distance  from  the  localizer  transmitter,  and 
(?)  the  point  where  1(X3  feet  above  the  ground  is  reached;  these  criteria 
shall  be  based  on  a Category  II  localizer  ground  installation  and  10,000 
foot  runway  is  defined  by  ICAO  Annex  10. 

3. 1.2. 9. 2 Glide  slope  mode  The  pitch  iVFCS  shall  cause  the  aircraft  to 
maneuver  to  acquire  the  glide  slope  beam.  Neither  the  position  of  the  air- 
craft above  or  below  the  glide  slope  nor  vertical  speed  of  the  aircraft  at 
time  of  mode  selection  shall  be  incorporated  as  a precondition  for  mode 
engagement.  When  preconditions  are  satisfied,  overshoot  shall  not  exceed 
0.16  degrees  (35  44  a)  of  radial  error  from  glide  slope  beam  center  when 
capturing  from  below  the  beam  in  level  flight  at  an  altitude  greater  f^han 
800  feet  above  the  glide  slope  transmitter  datum  altitude  in  a no-wind 
condition.  The  system  shall  exhibit  a damping  ratio  of  0.085  or  greater 
subsequent  to  the  first  overshoot  for  >.he  conditions  defined.  On  a Category 
II  ILS  ground  facility  (Including  10,000  foot  runway)  as  defined  in  ICAO 
Annex  10,  the  pitch  AFCS  shall  maintain  the  aircraft  glide  slope  antenna 

2 0* opposition  within  0.16  degrees  (35  x a)  of  beam  center  or  witliln  12  feet 
of  beam  center,  whichever  is  greater,  between  the  altitudes  of  700  feet  and 
100  feet  above  the  glide  slope  transmitter  datum. 

3. 1.2. 9. 3 Go-around  mode.  The  automatic  go-around  node  shall  be  manually 
engaged  only.  The  AFCS  shall  be  designed  such  that  no  single  failure,  or 
combination  of  failures  not  extremely  remote,  will  cause  the  aircraft  to 
maneuver  to  increase  the  rate  of  descent  upon  engaging  the  go-around  mode. 

If  the  go-around  mode  is  designed  for  concurrent  operation  with  other  auto- 
matic control  systems,  a single  switch  location  or  pilot  action  shall  engage 
all  systems  into  the  appropriate  mode  for  go-around.  Should  one  or  any 
combination  of  concurrently  operating  automatic  control  systems  be  inopera- 
tive at  the  time  of  AFCS  go-around  mode  engagement,  the  AFCS  shall  compl.: 
with  the  performance  requirements  based  on  normal  go-around  procedures 
including  manual  management  of  thrust,  flaps,  and  landing  gear. 

3. 1.2. 9. 3.1  Pitch  AFCS  go-around  . The  pitch  ^JCS  shall  cause  the  aircraft 
to  smoothly  rotate  sufficiently  to  establish  a positive  rate  of  climb  such 
that  the  aircraft  will  not  intersect  the  obstacle  clearance  planes  defined 
in  FAA  Advisory  Circular  120-29  more  often  than  1 in  10^  events  for  the  wind 
conditions  defined  in  3. 1.2. 9,  and  including  high  altitude,  hot  day  conditions 
as  defined  by  the  procuring  activity.  In  the  event  of  inadvertent  loss  of  an 
engine  just  prior  to  or  dviring  automatic  go-around,  the  system  shall  not  cause 
the  aircraft  to  approach  stall  within  30  seconds  of  mode  engagement,  based  on 
design  approach  speed.  If  operating  procedures  require  the  mode  to  be  disen- 
gaged upon  Inadvertent  loss  of  an  engine,  a timely  warning  shall  be  provided 
for  the  pilot  to  initiate  the  disengage  procedure.  Disengagement  under  this 
condition  shall  be  accomplished  manually. 

3 . 1 . 2 . 9 . 3 . 2 Lateral-heading  AFCS  go-around  performance  standards.  The 
lateral-heading  AFCS  shall  maintain  the  aircraft  4 o'  position  within  the 
lateral  boundaries  of  the  obstacle  clearance  planes  during  wind  conditions 

as  specified  in  3. 1.2. 9.  This  capability  shall  be  maintained  in  the  event  of 
the  most  critical  engine  failure  Just  prior  to  or  during  automatic  go-around. 
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If  normal  procedure  Is  to  disengage  the  go-around  mode  after  Inadvertent 
loss  of  one  engine,  under  the  wind  conditions  cited  a pilot  of  normal  skill 
shall  be  able  to  recover  airplane  heading  such  that  Intersection  with  the 
obstacle  clearance  planes  will  occur  no  more  than  1 In  10^  events  during 
recovery. 


3. 1.2. 9. 3. 3 Minimum  Go-around  altitude.  A minimum  altitude  for  engaging 
automatic  go-around  shall  be  established  such  that  the  probability  of 
Incurring  structural  damage  to  the  landing  gear,  wing  tips,  or  control 
surface  Is  extremely  remote.  The  minimum  altitude  shall  Include  normal 
performance  under  the  wind  conditions  specified  In  3. 1.2. 9 and  the  proba- 
bility of  Inadvertent  loss  of  an  engine  at  any  time  within  12  seconds 
preceding  mode  engagement. 

DISCUSSION 

The  performance  requirements  established  for  VOR/TACAN  operation  are 
based  on  current  aviation  Industry  practices  and  represent  the  cumulative 
effect  of  evolution  of  airborne  equipment  capability  and  pilot  acceptability. 

The  overstation  mode  requirements  for  VOR  and  TACAN  defined  in  3. 1.8. 1.3 
Include  provisions  for  resetting  the  beam  capture  logic.  One  of  the  more 
common  complaints  from  military  and  commercial  pilots  relates  to  limited 
capture  performance  for  the  outboard  radial.  Generally  these  complaints  have 
occurred  because  the  AFCS  remains  In  a tracking  mode  during  station  over- 
flight. Consequently,  outboard  captures  are  hampered  by  extremely  limited 
bank  angles,  etc.,  designed  to  ensure  good  tracking  performance.  Future 
configurations  should  provide  for  more  favorable  outbound  capture  performance 
by  development  of  more  comprehensive  control  laws  or  providing  capture  logic 
reset  as  a function  of  station  overflight. 

With  the  addition  of  Inertial  navigation  systems  and  area  navigation 
systems  to  the  airborne  computer  Installation,  substantial  additional  compu- 
tational capability  Is  established  external  to  the  traditional  autopilot 
computers.  Thus,  the  location  of  specific  control  laws  such  as  VOR, 
localizer,  and  glide  slope  modes  have  become  more  flexible.  Depending  upon 
the  specific  aircraft  configuration.  It  may  be  practical  to  process  the 
control  Information  for  these  modes  externally  to  the  autopilot  computers 
and  to  provide  steering  conriand  signals  to  the  AFCS  in  lieu  of  raw  data. 

Specific  requirements  for  Inertial  Navlg£.tion,  Area  Navigation,  or 
Vertical  Navigation  control  are  not  Included  In  this  specification  since 
these  requirements  will  depend  on  the  aircraft  mission.  Normally  these 
requirements  will  be  Included  in  the  procurement  detailed  specification, 
when  such  functions  are  required. 

Requirements  for  a Microwave  Landing  System  (MLS)  approach  mode  have 
not  been  Incxuded  because  of  the  lack  of  definitive  information  on  MLS 
ground  facilities  and  contingent  approach  procedures. 

The  main  point  of  the  Automatic  Instrument  Low  Approach  System  require- 
ment Is  to  emphasize  that  the  purpose  of  an  approach  coupler  is  to  position 
the  aircraft  accurately  at  a point  from  which  a landing  may  be  safely  com- 
pleted. Critical  failures  in  the  system  must  be  annunciated  quickly  enough 
that  the  crew  miy  take  effective  corrective  action. 
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The  localizer  mode  and  approach  coupler  mode  requirements  Include  the 
envlronmrjntal  conditions  under  vhlch  the  requirements  shall  be  met.  Minimum 
damping  is  specified;  however,  these  values  will  normally  be  exceeded  since 
the  operation  In  turbulence  requirements  of  3. 1.3. 7 should  dictate  damping 
levels. 

The  environmental  conditions  comprise  probable  combinations  of  head, 
tall  and  crosswinds  determined  from  statistical  combinations  (l.e.,  mutual 
convolution)  of  the  wind  distribute, 'vs  as  Illustrated  In  Figure  2. 

If  certain  other  automatic  functions  must  be  operable  to  meet  the 
requirements,  e.g. .stability  augmentation  systems  or  autothrottles,  this 
must  be  clearly  stated  In  the  FCS  Analysis  Report. 

The  localizer  mode  and  approach  coupler  mode  requirements  Include  the 
environmental  conditions  under  which  the  requirements  shall  be  met.  If 
certain  other  automatic  functions  must  be  operable  to  meet  the  requirements, 
e.g.,  stability  augmentation  systems  or  autothrottles,  this  must  be  clearly 
stated  in  the  FCS  Analysis  Report. 

3.1.2.10  All  weather  landing  system.  The  following  all  weath<;r  landing 
system  requirements  pertain  to  the  latter  stages  of  'the  approach;  l.e. , that 
portion  of  the  approach  below  the  decision  height  or  the  alert  height,  as 
defined  in  6.6.  All  weather  landing  system  shall  comply  with  the  following 
landing  accuracies: 

a.  Longitudinal  dispersion  of  the  main  landing  gear  touchdown  point 
shall  not  exceed  1500  feet  with  a 2-slgma  probability,  with  a mean  touchdown 
point  beyond  the  glldeslope  intersection  with  the  runway.  The  1500  foot 
dispersion  need  not  be  symmetrically  located  about  the  nominal  touchdown 
point.  The  aircraft  sink  rate  at  touchdown  shall  not  exceed  the  structural 
limit  of  the  landing  gear  except  as  an  extremely  remote  (6.6)  occurrence. 

b.  The  lateral  dispersion  of  the  aircraft  centerline  at  the  main 
landing  gear  at  touchdown  shall  not  exceed  27  feet  on  either  side  of  the 
runway  centerline  with  a 2-slgma  probability.  The  roll  out  guidance  system 
(normally  used  during  ICAO  Category  Illb  or  IIIc  visibility  conditions) 
shall  cause  the  aircraft  to  track  parallel  to  or  convergent  with  thv'?  center- 
line  of  the  runway. 

c.  The  systems  shall  meet  these  requirements  considering  reasonable 
combinations  of  head  winds  to  25  knots,  tail  winds  to  10  knots,  and 
crosswinds  to  15  knots,  according  to  the  probability  of  encountering 
these  winds  and  their  associated  turbulence  as  specified  In  3. 1.3. 7. 3, 
along  with  expected  variations  in  aircraft  configurations  as  specified  In 
3.1.2.10.1,  and  expected  variations  In  ground  facility  performance  as 
specified  in  3.1.2.10.2. 

3.1.2.10.1  All  weather  landing  performance  standards  - variations  of 
aircraft  and  airborne  equipment  configurations.  All  weather  landing  perform- 
ance requirements  shall  be  met  while  Including  the  effects  on  performance  of 
the  following  aircraft  and  airborne  equipment  variations  expected  to  occur 
In  normal  service. 
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a.  Landing  weight  and  center  of  gravity  variations. 

b.  Landing  flap  setting  variations. 

c.  Aircraft  approach  speed  variations. 

d.  Glide  tilope  and  localizer  airborne  receiver  centering  errors. 

e.  AFCS  all  weather  landing  system  sensor,  computer  and  servoactuator 
tolerances. 

f.  Performance  tolerances  of  automatic  control  systems  operating  con- 
currently with  the  AFCS  all  weather  landing  system;  e.g.,  stability 
augmentation  systems,  load  alleviation  systems. 

3.1.2.10.2  Performance  standards  - ground  based  equipment  variations.  Proof 
of  compliance  with  performance  requirements  for  All  Veather  Landing  systems 
shall  Include  the  effects  of  expected  variation  in  type  and  quality  of  the 
ground  based  equipment.  ILS  beam  structure,  associated  tolerances  and  align- 
ment errors,  monitoring,  touchdown  zone  lighting,  terrain  clearances,  and 
controlled  or  critical  taxi  zones  shall  be  considered  to  meet  the  require- 
ments for  Categories  II  or  III  operations  as  defined  by  ICAO  Annex  10. 

DISCUSSION 

All  weather  landing  refers  to  those  approaches  conducted  in  limited 
visibility  conditions  such  as  those  defined  by  ICAO  as  Category  II  or 
Category  III  visibility  conditions.  Performance  requirements  for  the 
initial  stages  of  the  approach,  l.e.,  from  ILS  capture  to  the  decision 
height,  are  defined  in  3. 1.2. 9.1,  Localizer  Mode,  and  3. 1.2. 9. 2,  Glide  Slope 
Mode.  Performance  requirements  for  the  remainder  of  the  approach,  touchdown, 
and  roll  out  are  defined  in  3.1.2.10. 

The  requirements  are  Intended  to  apply  to  conventional  takeoff  and  land 
aircraft.  Dispersion  requirements,  for  example,  may  be  more  stringent  for 
STOL  aircraft. 

Because  of  the  limitations  of  pilot  perception  and  aircraft  maneuver- 
ability under  the  combined  Influence  of  limited  visibility  and  operations 
at  extremely  low  altitudes,  the  primary  emphasis  of  design  for  all  weather 
landing  systems  is  in  terms  of  assuri  safety  of  operation  of  the  system. 
Although  all  weather  landing  state  (.'f-the-art  has  been  generally  established 
through  government  and  military  programs,  codification  of  all  weather  land- 
ing requirements  has  occurred  to  a greeter  degree  in  civil  programs  because 
of  their  relationship  with  and  obligations  to  various  regulatory  agencies 
around  the  world.  Thus  it  is  ration« 1 for  MIL-F-9A90  to  draw  upon  the  civil 
codifying  experience  for  not  only  that  wlilch  is  presently  existing,  but  to 
include  trends  which  are  obvious  to  the  Industry  as  additional  experience 
with  various  all  weather  landing  systems*  configurations  is  accrued.  For 
this  reason,  the  requirements  given  herein  are  based  on  the  performance 
accuracies,  reliability  requirements,  and  methods  of  showing  compliances 
with  the  requirements  as  defined  in  FAA  advisory  circulars  20-57A,  120-28A, 
and  120-29,  and  in  CAA  paper  number  367.  See  also  the  further  discussion 
of  the  closely  related  requirements  on  all  weather  landing  system  relia- 
bility and  hazard  analyses,  3. 1.7.1. 
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In  order  to  provide  a baseline  of  normal  performance  to  substantiate 
system  safety  of  operation  during  "no-fault"  conditions,  a statistical 
analyses  of  touchdown  performance  must  be  provided  which  Includes  the 
expected  variation  of  performance-affecting  parameters  which  are  common  to 
all  aircraft.  Unusual  modes  of  operation,  or  parameters  which  are  peculiar 
to  certain  aircraft  are  not  Included  In  the  list  of  parameters  provided  In 
3.1.2.10.1  and  3.1.2.10.2.  It  Is  expected  that  these  will  be  specified  by 
the  responsible  procurement  activity. 

Normal  performance  (boundary  conditions)  have  not  been  defined  here. 
These  latter  conditions  must  be  established  through  analysis  of  associated 
specific  risks  (as  defined  In  3. 1.7. 1.2).  This  analysis  may  lead  to  limit- 
ing requirements  such  as  those  defined  In  FAA  advisory  circular  20-57A. 

A statistical  model  must  be  derived  to  show  the  probability  distribu- 
tion of  each  parameter  considered  In  the  analysis.  The  dispersions  due  to 
each  of  these  parameters  must  be  calculated  and  mutually  convolved  to  pro- 
vide a cumulative  dispersion  using  the  expression: 

P(y>Y)  - / P(y  >Y/di,d2,...dn)ddi,dd2,...ddn 

P(y  ^ ■ probability  that  dispersion  y exceeds  the  given  value  Y 

dj^,d2...d^  are  the  disturbances 

A discussion  of  the  calculations  Involved  Is  contained  In  References  14, 
15,  16  and  17. 

3.1.2.11  Flight  load  fatigue  alleviation.  A fatigue  alleviation  control 
system  may  be  used  where  It  Is  advantageous  to  the  weapon  system.  The 
fatigue  alleviation  system  shall  comply  with  applicable  requirements  of 
MIL-A-8866  in  addition  to  the  requirements  of  this  specification. 

DISCUSSION 

The  performance  requirements  for  fatigue  alleviation  systems  are 
Included  In  the  structures  specifications.  As  the  name  Implies,  the  primary 
purpose  of  these  systems  is  to  reduce  fatigue  damage  rate  at  critical  loca- 
tions and  thereby  extend  airframe  fatigue  life.  The  B-52G  and  H fleet 
currently  includes  a system  which  provides  both  a stability  augmentation 
function  and  a facigue  alleviation  function.  References  18  and  19. 

Where  a Structural  Mode  Control  System  is  Implemented  as  a noncrltical 
FCS,  the  interaction  between  the  structural  system  and  essential  or  flight 
phase  essential  manual  FCS  augmentation  functions  should  be  minimized. 
Separation  is  normally  needed  by  bandpass  or  frequency  of  operation  to  avoid 
changes  in  flying  qualities  with  and  without  the  Structural  Mode  Control 
System.  This  separation  may  be  attained  through  use  of  bandpass  filters, 
washout  networks  or  multiple  sensors. 

Separation  may  also  be  needed  in  system  implementation  to  prevent 
failure  propagation  from  structural  systems  Into  a system  of  higher  criti- 
cality. Use  of  dedicated  surfaces  should  always  be  considered  to  obtain 
failure  Immunity.  Generally,  the  control  surfaces  used  for  manual  control 
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are  not  properly  located  to  obtain  best  structural  mode  control  performance 
and  an  Increment  In  performance  may  also  be  obtained  through  use  of  properly 
located  and  dedicated  control  surfaces. 


Fatigue  alleviation  systems  normally  operate  at  relatively  high  fre- 
quencies and  at  relatively  low  forces.  When  control  surfaces  are  used  for 
Fatigue  Alleviation,  which  are  also  required  to  provide  the  relatively  high 
forces  needed  for  manual  control,  low  control  surface  amplitudes  result. 
Consequently  the  effects  of  hysteresis,  backlash  and  similar  nonllnearltles 
are  more  Important  and  require  a more  detailed  nonlinear  analysis  than  Is 
needed  for  automatic  FCS  operating  at  lower  frequencies  and  higher  ampli- 
tudes. Where  practical,  force  and  moment  producers  should  always  be 
selected  to  best  provide  the  functions  needed.  Use  of  properly  located 
and  sized  control  surfaces  for  Structural  Mode  Control  will  eliminate 
problems  of  this  type. 

As  part  of  a fatigue  alleviation  synthesis,  some  consideration  should 
be  given  to  the  effect  on  loads  at  all  airframe  locations  and  not  Just  at  the 
fatigue  critical  location.  Among  loading  sources  normally  considered  when 
evaluating  the  performance  of  fatigue  alleviation  systems  are:  flight  In 

turbulence,  ground-alr-ground  cycles  and  maneuver  loading. 

3.1.2.12  Ride  smoothing.  With  the  Ride  Smoothing  AFCS  and  other  FCS  In 
Operational  State  I,  the  following  short  term  and  applicable  long  term 
vertical  or  lateral  axis  ride  discomfort  Index  levels  shall  not  be  exceeded 
at  any  crew  station  during  flight  In  the  turbulence  level  specified  In 
Table  II. 


TABLE  II 

RIDE  DISCOMFORT  INDEX  LIMITS 


1 

Ride  Discomfort 
Index,  D| 

Flight  Phase  Duration 
(Exposure  Time) 

Long  Term 

Over  3 Hours 

Requirement 

From  1.5  to  3 Hours 

0.20 

From  0.5  to  1.5  Hours 

Short  Term 

0.28 

Less  than  0.5  Hour 

Requirement 

Probability  of  Exceeding 
RMS  Turbulence  Intensity 


The  requirements  apply,  separately,  to  each  of  the  vertical  and  lateral 
axes.  For  the  lateral  axis  requirement  only  lateral  gusts  apply  and  for 
vertical  acceleration  only  vertical  gusts  apply.  Effects  of  attitude  hold 
or  other  pertinent  AFCS  modes  shall  be  Included  where  used.  This  require- 
ment normally  applies  only  where  a Ride  Smoothing  AFCS  Is  specified  by  the 
procuring  activity.  However,  where  ride  smoothing  Is  not  specified  and 
other  AFCS  modes  degrade  ride  quality,  the  resulting  ride  shall  not  degrade 
to  below  the  levels  specified. 


■EC. 


3.1.2.12.1  Ride  discomfort  Index.  Ride  discomfort  Index  la  defined  as? 


D: 


(0j2|Tcs(0|2  0u(Odf 


1/2 


“1 

W(f) 


T (f) 
cs'  ' 


(f) 


Ride  Discomfort  Index»  (vertical  or  lateral) 

Acceleration  weighting  function  (vertical  or  lateral)  1/g 

Transmlsslblllty,  at  crew  station » g/ft/aec 

Von  Karman  gust  power  spectral  density  of  Intensity 
specified  in  3.1.2.12  and  form  specified  in  MIL-F-8785 

Frequency,  Hz 

Truncation  frequency  (frequency  beyond  which  aeroelastlc 
responses  are  no  longer  significant  In  turbulence  (1) 


Acceleration  weighting  functions  are  defined  for  vertical  and  lateral 
acceleration  by  figure  1.  Probability  of  exceedance  versus  turbulence 
Intensity  is  specified  in  3. 1.3. 7. 


DISCUSSION 


Vilhen  used,  r:^de  smoothing  systems  are  required  to  provide  a degree  of 
ride  quality  as  defined  by  the  Ride  Discomfort  Index.  Ride  requirements  are 
stated  In  terms  of  probabilities,  since  the  ride  discomfort  addressed  by 
this  requirement  is  generated  by  random  turbulence.  The  exceedance  proba- 
bilities and  correes  ing  Ride  Discomfort  Index  values  specified  are  based 
on  the  recommendatl  of  References  20  and  21.  Generally  these  requirements 
should  provide  ride  quality  equal  to  or  better  than  that  existing  in  cur- 
rently operating  aircraft  within  the  USAF  inventory. 

The  ride  requirement  for  the  basic  aircraft,  without  a ride  smoothing 
system,  is  Included  in  MIL-A-8892.  This  requirement  currently  limits  any 
single  frequency  vibration  to  j<).l  g,  zero  to  peak,  at  frequencies  below 
22  Hertz.  This  MIL-A-8892  requirement  is  currently  being  considered  for 
revision  within  the  AFFDL  to  Include  coverage  similar  to  that  Included  here. 
Consideration  of  multiple  frequency  aeroelastlc  responses  and  human 
sensitivity  weighting  factors  Is  considered  mandatory  for  evaltiatlon  of  ride 
in  turbulence. 


There  is  disagreement  in  the  literature  on  the  proper  approach  for  eval- 
uating combined  axis  accelerations.  Reference  20  recommends  a method  for 
evaluating  combined  axis  accelerations  based  on  USAF  experience.  Reference  22, 
the  ISO  standard,  recommends  that  irceleratlons  In  separate  axes  be  considered 
separately;  and  Reference  23,  a commercial  aircraft  study,  recommended  miother 
method  for  combined  axis  acceleration  evaluation. 
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Due  to  the  leek  of  agreement  on  method  and  limited  test  data  available 
on  combined  axis  accelerations,  this  requirement  follows  the  ISO  recomenda- 
tion  and  places  re.iulrements  only  on  vertical  and  lateral  axis  accelerations, 
separately.  The  re*;der  should  note  that  vertical  ride  discomfort  is  to  be 
evaluated  due  to  vertical  axis  turbulence  only  and  lateral  ride  evaluated  due 
to  lateral  turbulence  only.  No  requirement  is  specified  for  roll  gusts  or 
longitudinal  gusts,  although  for  some  STOL  applications  longitudinal  gusts 
should  be  considered. 

The  turbulence  intensities  to  be  used  are  determined  by  the  exceedance 
probabilities  specified  for  Ride  Discomfort  Index.  Generally,  the  system  is 
required  to  reduce  ride  discomfort  to  the  levels  specified  while  flying  in 
turbulence  with  a cumulative  axcoedance  probability  equal  to  or  less  than 
the  probability  specified.  System  nonlinearities  must  be  considered.  Sys- 
tem deadzone  and  other  nonlinearitios  must  not  be  so  large  that  ride  dis- 
comfort exceeds  the  0.10  or  other  pertinent  long  term  limits  in  light 
turbulence.  System  saturation  must  no.  be  so  severe  in  turbulence  at  the 
0.01  exceedance  level  that  the  0.28  rlO^  discomfort  limit  is  exceeded.  The 
reliability  requirements  for  implementing  a ride  smoothing  system  are  speci- 
fied, in  terms  of  mission  accomplishment  probability,  in  3.1.6.  The  reader 
should  note  that  cumulative  exceedance  probaMlltles  for  turbulence  are 
stated  in  terms  of  stationary  probabilities  rtther  than  the  nonstationary 
probabilities  used  in  reliability  work. 

Turbulence  exceedance  probabilities  are  tabul.>ted  in  Table  V of  3. 1.3. 7. 

A stationary  probability  or  cumulative  probabili'-y  of  exceedance  for 
turbulence  encounter  means  that  at  a randomly  selected  time  during  flight, 
the  probability  of  being  in  turbulence  at  or  above  the  s:-at<*d  intensity  is 
of  a given  value.  This  does  not  define  the  probability  of  exceeding  a 
given  level  of  turbulenca  during  a given  flight  or  flight  sogment.  On  a 
fleet  lifetime  basis,  this  probability  can  be  Interpreted  as  the  portion  of 
total  flight  time  to  be  spent  above  the  stated  Intensity.  Since  the  statis- 
tics upon  which  these  probabilities  are  based  were  measured  over  extended 
operating  times,  the  temptation  to  convert  these  values  to  hours/hour  or 
hours  per  individual  flight  should  be  resisted. 

The  levels  of  ride  discomfort  specified  are  based  on  short  term  toler- 
ance and  long  term  tolerance.  Data  from  References  20,  22  and  24,  indicijte 
that  below  a Ride  Dis':onfor;:  Index  of  0.07,  little  or  no  degradation  in  craw 
performance  or  passenger  comfort  is  expected.  Above  a Ride  Discomfort  Index 
of  0.28  the  USAF  references  indicate  crew  action  must  be  initiated  to  reduce 
the  acceleration  environment  by  changing  flight  path,  altitude  and/or  air- 
speed. Figure  2D  Illustrates  unpublished  data  from  a commercial  airplane 
moving  base  simulator  study  in  terms  of  incremental  pilot  ratings  (Cooper 
scale)  due  to  accelerations  which  also  indicate  a limit  near  0.28  for  an 
Incremental  pilot  rating  of  3.  (Note  that  a satisfactory  rating  of  3.5  in 
calm  air  plus  an  incrensrital  I'ating  of  3 in  turbulence  yields  a total  rating 
of  6.5.) 
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VERTICAL  ACCELERATION  ~ An^  - RMS  g’« 


NOTES: 


1.  UNPUBLISHED  DOEINO  DATA  FOR 
COMMERCIAL  AIRPLANES 

2.  DATA  OBTAINED  FROM  MOVING 
BASE  SIMULATOR  STUDY 


Figure  2D.  Effect  of  combined  acceleration  on  pilot  rating 
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The  only  known  production  ride  emoothing  eysten  designed  to  dete,  the 
B-1  systetn»  used  « vcrticsl  long  tern  index  near  0.10.  The  lateral  B-^l 
requirement  was  more  stringent.  Connercial  feasibility  studies  have  used 
much  more  conservative  design  goals.  Reference  25,  for  example,  used  an 
unweighted  index  of  0.03  in  0.01  turbulence.  This  ia  equivalent  to  an 
unweighted  index  of  0.015  in  0.20  titrbulence  at  low  level  and  is  roughly  a 
factor  of  10  more  stringent  than  che  MIL»F-9490D  criterion.  The  procuring 
activity,  of  course,  may  redefine  the  required  values  of  the  ride  discom- 
fort index  to  be  used  for  specific  procurements,  based  on  unique  mission 
requirements. 

The  B'-52  is  known  for  its  marginal  ride  during  low  level  penetrations. 
When  compared  to  this  long  term  criteria  (3  hrs.  - 0.10)  the  B-52  exceeds 
thi'  criterion  for  medium  and  light  gross  weights  and  satisfies  the  criterion 
for  heavier  gross  weights.  Thus,  for  the  initial  penetration  flight  phase 
the  B-S2  ride  is  acceptable. 

For  later  phases  the  ride  is  unacceptable,  if  the  remaining  low  level 
flight  phase  exceeds  three  hours. 

The  Figure  1 acceleration  weighting  functions  are  based  on  the 
MIL-srD-lA72  human  sensitivity  curves.  Reference  22,  as  extrapolated  to 
lower  frequencies  by  Reference  26.  The  extrapolations  below  1.0  Herts, 
especially  for  lateral  vibration,  are  supported  by  a minimum  of  data.  How- 
ever, the  values  defined  represent  the  best  current  consensus  of  experts 
within  the  6750th  Aerospace  Medical  Research  Laboratory  and  reflect  the 
current  U.S.  recommendation  to  the  International  Organisation  for  Standard- 
isation for  human  exposure  to  vibration  from  0.1  to  1.0  Herts.  The  weighting 
functions  defined  are  truncated  at  0.1  Herts  and  at  high  frequencies. 

The  reason  for  weighting  function  truncation  is  the  liiaitations  of  the 
test  equipment  used  to  generate  data  upon  which  these  curves  are  based. 

Moving  base  simulators  can  be  used  to  simulate  aircraft  at  low  frequencies; 
however,  the  data  obtained  below  0.1  to  0.2  Herts  is  of  questionable  value 
since  continuous  oscillations  at  these  frequencie3  do  not  normally  occur  in 
flight.  In  many  cases,  the  pilot  or  AFCS  will  control  low  frequency  motions, 
effectively  smoothing  these  oscillations  and  reducing  the  truncation  error 
resulting  from  this  approach.  (See  Reference  27.)  Note  that  attitude  hold 
or  other  pertinent  modes  are  to  be  simulated  to  satisfy  this  requirement. 
These  modes  should  approximate  pilot  or  AFCS  suppression  of  low  frequency 
responses.  Truncation  at  higher  frequencies  is  permitted  since  the  gust 
spectrum  has  very  little  power  beyond  30  Hertz.  Since  structural  models 
seldom  extend  to  30  Hertz,  in  practice  integration  i.-  normally  stopped  near 
the  frequency  of  the  highest  aeroelastlc  mode  modeled.  The  requirement  is 
to  Include  significant  effects  to  the  truncation  frequency.  Due  to  gust 
filter  roll  off.  Integration  beyond  15  Hertz  seldom  affects  the  integral 
value  significantly. 

The  intent  of  this  requirement  is  to  specify  the  ride  experienced  by  the 
crew.  Soft  seats  or  other  isolation  techniques  used  should  be  considered  in 
meeting  this  requirement.  Care  must  be  taken  that  relative  motion  between 
the  crew  member  and  his  controls  and  instruments,  resulting  from  isolation 
techniques,  does  not  degrade  crew  performance.  Visual  problems,  for  example, 
can  be  aggravated  by  relative  motion. 
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Th«re  are  ecveral  current  lourcca  of  literature  available  on  ride 
smoothing  syetema.  Reierence  28  describes  development  of  the  B-1  ride 
smoothing  system  which  was  synthesised  using  the  ILAF  concept.  References 
29  through  33  describe  the  development  of  the  ILAF  concept.  Reference  34 
describes  a study  olf  model  suppression  on  the  YF-12A  airplane. 

3.1.2.13  Active  flutter  suppression.  An  active  flutter  suppression  control 
system  may  be  used  where  it  is  advantageous  to  the  weapon  system.  The  flutter 
suppression  control  system  shall  conform  to  the  applicable  requirements  of 
MIL-A>8870  in  addition  to  the  requirements  of  this  specification. 

3.1.2.14  Gust  and  maneuver  load  alleviation.  An  active  gust  and  maneuver 
load  alleviation  control  system  may  be  used  where  it  is  advanteqeo  to  the 
weapon  system.  The  active  load  alleviation  control  system  shall  co..torm  to 
the  applicable  requirements  of  MIL-A-8861  in  addition  to  the  requirements  of 
this  specification. 

DISCUSSION 

Active  Flutter  Suppression  is  an  emerging  technology  and,  as  such,  few 
specific  requirements  have  been  suggested  for  such  systems.  References  35-43 
record  some  of  the  recent  development  in  flutter  suppression. 

Gust  and  maneuver  load  systems  are  also  currently  being  developed. 

Examples  are  the  B-52  CCV  program,  Referwi.re  44,  and  the  C-5A  Structural 
Improvement  program.  The  L-1011  also  relied  on  the  yaw  damper  to  reduce 
design  loads.  (See  Reference  27.) 

3.1.2.15  Automatic  terrain  following.  Performance  requirements  shall  be  as 
specified  by  the  procuring  activity. 

DISCUSSION 

Although  the  concept  of  automatic  terrain  following  is  well  founded,  the 
methodology  of  specifying  performance  is,  as  yet,  unproven.  Reference  45  pro- 
vides a discussion  of  recommended  criteria  for  the  design  of  Manual  and  Auto- 
matic Terrain  Following  Systems.  This  document  describes  recent  Terrain 
Following  literature  and  the  rationale  used  to  establish  terrain  following 
requirements.  Criteria  and  design  constraints  are  provided  in  the  inter- 
related areas  of  safety  perf(’''mance,  reliability,  stability,  vulnerability, 
structural  fatigue,  ride  comi  tt  and  costs. 

3.1.2.16  Control  stick  (or  wheel)  steering.  The  pilot  shall  retain  full 
capability  to  maneuver  the  airplane  within  the  applicable  control  force  and 
maneuver  limits  of  MIL-F-8785  or  MIL-F-83300.  Automatic  disengagement  of  the 
AFCS  with  reversion  to  manual  control  is  permitted  in  meeting  this  requirement. 

DISCUSSION 

Control  wheel  (or  stick)  steering  relies  on  the  use  of  the  control  wheel 
and/or  column  to  introduce  the  pilot's  manual  inputs  into  the  system  when  the 
AFCS  is  engaged  and  controlling  the  aircraft.  Many  different  types  of  steer- 
ing systems  exist  and  may  be  implemented  in  the  futute.  Two  basic  types 
include  the  proportional  type  and  the  disconnect  type. 
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Two  types  of  proportional  type  steering  systems  are  "power  steering" 
and  "controlled  reference"  systems.  These  systems  allow  the  AFCS  to  react 
in  a proportional  manner  to  pilot  Induced  force  on  the  control  wheel/stick. 

The  "power  steering"  type  system  merely  provides  power  boost  and, 
during  the  maneuver,  there  is  no  AFCS-provided  stabilization. 

The  "controlled  Reference"  steering  system  is  the  most  sophist  touted  of 
the  various  steering  systems.  The  AFCS  remains  engaged  during  maneuvers  and 
provides  whatever  stabi.1  zation  has  been  selected.  The  wheel  or  stick  force 
sensor  provides  a bias  as  a function  of  pilot  applied  manual  control  force 
to  modify  the  stabilization  of  the  AFCS.  The  controlled  parameter  .j 
normally  airplane  attitude;  however,  functions  such  as  vertical  speed,  flight 
path  angle,  Mach  number  or  turn  rate  may  also  be  implemented  as  the  con- 
trolled parameter.  The  datum  for  these  references  can  be  slewed  as  a func- 
tion of  force  applied  to  the  whcel/stick. 

The  disconnect  type  steering  systems  merely  disconnect  the  AFCS  tempor- 
arily during  a pilot  comraanded  maneuver  and  re-engages  following  completion. 
Force  switches  may  be  used  to  control  disconnect  and  re-engage  logic. 

The  intent  of  this  requirement  is  to  ensure  that  the  pilot  retains  full 
maneuver  capability.  The  disconnect  type  systems  attain  this  capability  by 
temporarily  disengaging  the  AFCS  and  relying  on  the  MFCS,  The  "power 
steering"  and  "controlled  reference"  type  system  may  also  be  designed  to 
automatically  disengage  the  AFCS  prior  to  reaching  design  maneuver  limits. 

For  example,  the  B-52  includes  a "g  limiter"  which  restricts  the  pilot  to 
less  than  design  g's  through  the  steering  system.  However,  design  maneuvers 
can  be  obtained  by  Increasing  control  forces,  such  that  the  AFCS  automatically 
reverts  to  manual  control  and  design  maneuvers  can  be  obtained  within  reason- 
able control  force  levels.  The  B-52  steering  system  is  designed  to  min.lmize 
the  transients  resulting  from  this  reversion  to  manual  control. 

This  requirement  also  includes  consideration  of  stick  force/g.  With  the 
steering  system  functioning,  stick  force/g  must  remain  within  the  range  of 
values  cited  in  the  flying  quality  specifications. 

3.1.3  General  FCS  design.  Flight  control  systems  shall  be  as  simple,  direct, 
and  foolproof  as  possible,  consistent  with  overall  system  requirements. 

3.1. 3.1  Redundancy.  The  contractor  shall  determine  the  redundancy  approaches 
and  levels  required  to  satisfy  the  requirements  of  this  specification. 

DISCUSSION 

Redundancy  may  be  needed  to  satisfy  the  reliability,  invulnerability, 
failure  immunity  or  other  requirements  of  this  specification.  Recent  fleet 
histories  have  shown  that  even  single  thread  mechanical  flight  control  can 
provide  high  reliability  and  failure  Immunity.  However,  mechanical  redun- 
dancy, electrical  redundancy  and  redundancy  obtained  through  mixing  mechan- 
ical and  electrical  controls  is  often  used  to  obtain  improved  reliability, 
invulnerability  and  failure  immunity  characteristics.  Use  of  dissimilai- 
parts  is  a preferred  approach  for  obtaining  viable  redundancy. 
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For  electrical  flight  controls,  redundancy  is  easily  obtained  and  is 
commonly  used  to  obtain  single  and  dual  fail  operate  systems.  Table  ID 
Illustrates  minimum  redundancy  levels  for  the  corresponding  controls. 

TABLE  ID 

MINIMUM  REDUNDANCY  LEVELS  FOR  NONMECHANICAL  IMPLEMENTATIONS 


FCS  CRITICALITY 

MINIMUM  REDUNDANCY 

Essential 

Fail-Operational 

Flight  Phase  Essential 

Fail-Passive 

Noncritical 

Fail-Safe 

In  practice,  these  redundancy  avels  are  normally  exceeded  by  one  level  for 
the  flight  phase  essential  and  essential  controls  due  to  reliability, 
flight  safety  or  other  considerations  for  the  particular  implementation. 

3. 1.3. 2 Failure  immunity  and  safety  Within  the  permissible  flight 
envelope,  no  single  failure  or  failure  combination,  which  is  not  extremely 
remote,  in  the  FCS  or  related  subsystems  shall  result  in  any  of  the  following 
effects  before  a pilot  or  safety  device  can  be  expected  to  take  effective 
corrective  action.  For  this  specification,  extremely  remote  is  defined  as 
numerically  equal  to  the  maximum  aircraft  loss  rate  due  to  relevant  FCS 
material  failures  specified  in  3.1.7. 

a.  Flutter,  divergence,  or  other  aeroelastic  instabilities  within  the 
permissible  flight  envelope  of  the  aircraft,  or  a structural  damping  coef- 
ficient for  any  critical  flutter  mode  below  the  fail-safe  stability  limit 
of  MIL-A-8870. 

b.  Uncontrollable  motions  of  the  aircraft  or  maneuvers  which  exceed 
limit  airframe  loads. 

c.  Inability  to  safely  land  the  aircraft. 

d.  Any  asymmetric,  unsynchroniz«_d , unusual  operation  or  lack  of  opera- 
tion of  flight  controls  that  results  in  worse  than  FCS  Operational  State  III. 

e.  Exceedance  of  the  permissible  flight  envelope  or  inability  to  return 
to  the  service  flight  envelope. 

DISCUSSION 

The  intent  of  this  requirement  is  to  insure  that  no  failure  (s),  not 
extremely  remote,  can  result  in  an  inflight  hazard.  For  noncritical  controls 
the  pilot  may  be  required  to  detect  and  counteract  failures  by  either  deactiv- 
ating the  controls  or  the  failed  portion  thereof,  or  by  overriding.  When 
this  occurs,  use  of  the  controls  must  not  require  exceptional  pilot  skill  or 
strength,  and  should  allow  use  of  the  controls  in  the  normal  sense  during 
override . 
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This  requirement  does  not  absolutely  require  redundancy.  Recent  fleet 
history,  References  46  and  47,  shows  that  single  thread  mechanical  controls 
can  provide  failure  immunity  with  high  reliability.  However,  as  control 
technology  evolves  the  trend  is  toward  electrical  Implementations  with 
multiple  redundancy.  In  each  procurement,  the  procuring  activity  will 
specify  the  numerical  probability  associated  with  the  term  "extremely 
remote"  (See  definition  in  6.6)  and  the  contractor  will  establish  failure 
rate  prediction  needed  to  satisfy  this  requirement.  The  reader  should  note 
that  roechanlzaclons  which  satisfy  these  failure  immunity  requirements  are 
necessary,  but  may  not  be  sufficient  to  meet  reliability  or  flight  safety 
requirements.  For  example,  most  redundant  systems  provide  at  least  a single 
fail  operate  capability,  where  little  or  no  degradation  in  performance 
results  from  single  failures. 

Mechanical  interconnection  of  flaps  and  other  controls  may  be  required 
to  provide  the  synchronization  required  by  (d).  If  a mechanical  flap  inter- 
connection is  required  to  meet  synchronization  requirements,  it  must  satisfy 
thr  structural  integrity  requirements  o^  3.1.11.  It  should  withstand 
applicable  unsymmetrical  loads  including  those  resulting  from  flight  with 
the  engines  on  one  side  of  the  plane  of  symmetry  inoperative  and  the  remain- 
ing engines  at  takeoff  power.  For  airplanes  with  flaps  that  are  not  sub- 
jected to  propeller  slipstream  or  engine  exhaust  conditions,  the  structure 
should  be  designed  for  the  loads  imposed  when  the  wing  flaps  on  one  side  are 
carrying  the  most  severe  load  occurring  in  the  prescribed  symmetrical  condi- 
tions and  those  on  the  other  side  are  carrying  not  more  than  80  percent  of 
that  load.  The  flap  interconnection  should  also  be  designed  for  the  loads 
resulting  when  the  flap  surfaces  on  one  side  of  the  plane  of  symmetry  are 
jammed  and  immovable  while  the  surfaces  on  the  other  side  are  free  to  move 
and  the  full  power  of  the  surface  actuating  system  is  applied. 

In  the  event  of  a failure  of  the  high  lift  control  system  actuators  such 
as  a screwjack,  hydraulic  cylinder,  etc.,  the  high  lift  device  should  main- 
tain synchronization,  or  remain  synchronized  without  motion.  There  are 
several  methods  of  providing  systems  which  will  do  this,  such  as  providing 
duplicate  push-pull  rods,  torque  tube  systems,  cable  systems,  etc.,  duplicat- 
ing the  drive  unit  and  installing  separate  actuators  at  each  high  lift 
device  segment  and  interconnecting  the  actuators,  and  providing  an  auto- 
matic shutoff  system  ',/hich  receives  position  signals  from  each  of  the 
segments  or  from  the  outer  ends  of  the  torque  tube  system.  i\ircraft  whose 
landing  roll  becomes  critical,  with  respect  to  normal  runway  lengths  and 
zero  wind  conditions,  if  high  lift  devices  are  not  available,  should  not  use 
automatic  shutoffs  which  may  deprive  them  of  the  use  of  these  devices. 

MIL.-F-9490C  included  specific  failure  immunity  requirements  in  terms  of 
limits  on  control  surface  rates  and  authority  and  in  terms  of  structural 
protection  means.  To  meet  the  more  general  failure  immunity  requirements  of 
this  specification,  these  areas  will  also  have  to  be  considered. 

For  example  for  intermittent  controls  such  as  trim,  high  lift  devices, 
etc.,  maximum  surface  rates  should  not  exceed  the  rate  which  can  create  a 
maneuver  generating  limit  airframe  loads  before  the  pilot  or  a safety  device 
can  react.  This  applies  at  all  flight  conditions,  both  at  the  maximum  air- 
speed at  which  the  control  surface  can  be  actuated  and  at  the  airspeed  at 
which  control  surface  operation  yields  maximum  structural  loading. 
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Inadvertent  flap  or  control  surface  retraction  or  extension  should  be 
considered  and  prsvented  If  hazardous  flight  occurrences  such  as  altitude 
loss  or  stall  during  landing  or  aerial  refueling  can  occur  due  to  such 
retraction  or  extension.  Inadvertent  surface  displacements  due  to  both 
failure  states  and  pilot  error  should  be  considered.  In  all  cases,  compen- 
sating action  by  the  pilot  should  be  considered,  when  pertinent,  following 
the  control  surface  movement.  For  large  commercial  aircraft  In  cruise,  a 
three  to  five  second  reaction  time  Is  commonly  used  to  represent  the  time 
required  to  react  and  regain  positive  control  following  failures.  Such 
time  delays  are  discussed  In  MIL-F-878SB  and  associated  backup  document 
AFFDL-TR-69-72,  Reference  1. 

Airplane  structure  should  not  be  endangered  by  FCS  or  Interfacing  sub- 
system malfunctions.  All  FCS  failure  states  resulting  In  a hazardous  sur- 
face oscillation,  hardover  or  other  hazardous  motion  which  cannot  be 
overcome  by  pilot  action  should  be  prevented  either  by  authority  limiting, 
redundancy  or  other  means. 

3. 1.3. 2.1  Automatic  terrain  following  failure  Immunity.  The  terrain  f-1- 
lowing  system  shall  detect  any  potentially  critical  failure,  not  shown  to 
be  extremely  remoted,  in  the  command  generation  scheme,  sensors,  (includ- 
ing radar  and  radar  altimeter)  or  terrain  following  AFCS  and  provide  warn- 
ing to  the  pilot.  Any  failure  resulting  In  loss  of  the  automatic  terrain 
following  function  or  unsafe  flying  condition  shall  provide  safe  exit 
(automatic  fly-up)  from  the  low  altitude,  high  speed  environment.  Take  over 
or  injection  of  commands  by  the  pilot  while  the  system  Is  operating  shall 
permit  a smooth  and  positive  transition  without  adverse  transients.  AFCS 
function  accuracy  (heading  and  roll  attitude  hold)  shall  be  maintained  to 
Che  degree  specified  in  3.1.2. 

DISCUSSION 

An  automatic  fly-up  coran  and  mechanization  should  be  provided  for  safe 
exit  while  in  the  ATF  mode,  llonitoring  of  aircraft  performance  whether 
by  an  external  sysvtem  (radar  altimeter  override)  or  integral  with  the 
control  law  should  utilize  both  altitude  and  altitude  rate.  Adequate  dis- 
play should  be  provided  to  allow  pilot  evaluation  of  the  situation. 

3. 1.3. 3 System  operation  and  Interface.  Wherever  a noncritical  control 
or  any  other  aircraft  .subsystem  is  Interfaced  with  essential  or  flight 
phase  essential  flight  control  channels,  separation  and  isolation  shall  be 
provided  to  make  the  probability  of  propagated  or  common  mode  fallurea 
extremely  remote. 

3. 1.3. 3.1  Warmup , After  power  is  applied  to  the  FCS,  the  warmup  time 
required  to  meet  this  specification  shall  not  be  more  than  90  seconds  for 
MIL-F-8785  Class  IV  aircraft  and  not  more  than  3 minutes  for  other  types  of 
aircraft. 

DISCUSSION 

This  requirement  applies  to  both  electronic,  hydraulic  and  other  system 
components.  Specified  system  performance  must  be  provided  following  this 
warmup  period.  Note  that  3.1.9  permits  temporary  State  II  performance  fol- 
lowing warmup  under  unusual  conditions. 
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3. 1.3. 3. 2 Disengagement . Provisions  shall  be  made  for  positive  inflight 
disengagement  of  flight  phase  essential  and  noncritical  electrical  controls 
under  all  load  conditlonb.  No  out  of  trim  condition  shall  exist  at  disen- 
gagement which  cannot  be  easily  controlled  by  the  pilot.  The  pilot  shall 
be  informed  of  automatic  disengagement.  Disengagement  circuitry  shall  be 
designed  such  that  a failure  of  the  circuitry  Itself  does  not  prevent  auto- 
matic or  manual  disengagement. 

3.1. 3.3.3  Mode  compatibility.  Mode  compatibility  logic  shall  provide  flexi- 
bility of  PCS  operation  and  ease  of  mode  selection.  The  mode  selection  logic 
shall i 


a.  Make  correct  mode  selection  by  the  crew  highly  probable. 

b.  Prevent  the  engagement  of  incompatible  modes  that  could  create  an 
immediate  undesirable  situation  or  hazard. 

c.  Disconnect  appropriate  previously  engaged  modes  upon  selection  of 
higher  priority  modes. 

d.  Provide  arming  of  appropriate  modes  while  certain  modes  are  engaged. 

e.  Provide  for  the  engagement  of  a more  basic  PCS  mode  in  the  event  of 
a failure  of  a higher  priority  mode. 

DISCUSSION 

When  a choice  of  PCS  mode  selections  is  made  available  it  is  necessary 
to  specify  a mode  hierarchy  and  to  ensure  that  the  mode  selection  logic  can 
handle  all  possible  combinations  of  desirable  and  Inadvertent  selection. 

3.1. 3.3.4  Failure  transients.  Aircraft  motions  following  sudden  flight  con- 
trol system  or  component  falluret,  shall  be  such  that  dangerous  conditions  can 
be  avoided  by  pilot  corrective  action.  Time  delays  between  the  failure  and 
initiation  of  pilot  corrective  action  shall  be  as  established  by  MIL-F-8785. 
Transients  due  to  failures  resulting  in  PCS  Operational  States  I or  II  within 
a redundant  PCS  shall  not  exceed  +0.5g  Incremental  normal  or  lateral  acceler- 
ation at  the  center-of-gravity  or  +10  deg/sec  roll  rate.  Transients  due  to 
failures  within  the  PCS  resulting  In  PCS  Operational  State  III  shall  not 
exceed  75  percent  of  limit  load  factor  or  +1.5  g's  from  the  Initial  value, 
whichever  Is  less,  at  the  most  severe  flight  condition. 

DISCUSSION 

These  failure  transient  requirements  have  been  set  considering  safety 
needs  and  characteristics  of  redundant  systems.  No  specific  limits  are  given 
for  sideslip  angle,  although  the  general  requirement  to  avoid  dange'’ous  condi- 
tions will  lead  to  the  contractor  establishing  limits  on  sideslip.  MIL-F-8785 
Includes  additional  failure  transient  requirements. 

3.1. 3.4  System  arrangement.  Systems  shall  be  arranged  as  required  to  satisfy 
the  reliability,  invulnerability,  failure  immunity  and  other  general  require- 
ments of  this  specification. 
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DISCUSSION 


System  arrangement  Is  largely  determined  by  the  general  requirements  of 
this  specification  s.tch  as  reliability  and  flight  safety.  System  separation, 
protection  and  clearance  is  specified  by  3. 2. 3. 1.2  for  signal  transmission 
elements. 


3. 1.3. 5 Trim  controls.  Each  of  the  principal  control  axes  shall  have  trim 
controls.  Wherever  worse  than  Operational  State  III  would  result  from  a 
power-operated  trim  control  failure  that  is  not  extremely  remote,  the  pilot 
shall  be  given  override  capability  for  the  failed  control.  For  series  trim 
control,  no  worse  than  Operational  State  III  shall  result  from  a trim  control 
becoming  inoperative  in  any  position,  except  for  extremely  remote  failures. 
Engagement  of  the  AFCS  shall  automatically  initiate  any  needed  pitch  trim. 
Aircraft  subject  to  short  alerts  shall  have  the  capability  incorporated  to 
return  all  trim  to  the  takeoff  position  automatically.  Any  automatically 
controlled  trim  shall  incorporate  positive  means  to  avoid  potentially 
hazardous  adverse  trim  near  stall.  In  multicrew  aircraft  with  electrical 
trim  systems,  Interlocks  in  the  circuitry  shall  prevent  simultaneous  commands 
by  two  aircrew  members  from  causing  any  operation  in  opposing  directions  at 
the  same  time. 

DISCUSSION 

These  controls  should  preclude  inadvertent  or  abrupt  operation  and  each 
should  operate  in  the  plane  and  sense  of  aircraft  motion  it  affec'  . Trim 
system  irreversibility  is  specified  in  MIL-F-8785  and  is  an  important  con- 
sideration. Airplanes  which  have  provisions  for  manual  control  of  essential 
or  flight  phase  essential  FCS  in  the  event  of  power  failure  should  also  pro- 
vide manual  trim  in  the  event  of  power  failure. 

Automatic  trimming  functions  must  operate  at  rates  which  allow  the  AFCS 
to  meet  AFCS  transient  performance  requirements. 

Inoperative  trim  is  a particularly  important  consideration  when  series 
trim  is  employed.  With  that  type  mechanization  the  stick  position  provides 
no  cue  about  the  amount  of  control  author! ry  remaining  to  the  pilot.  For 
other  mechanizations,  pilot  override  would  normally  be  considered  an  appro- 
priate way  to  provide  Operational  State  III. 

AFCS  trim  circuitry  should  be  arranged  to  reduce  the  effect  of  a failure 
in  the  AFCS  on  manual  trim  operation  following  AFCS  disengagement.  The 
failure  immunity  requirements  of  this  specification  set  limits  on  such  effects. 

Care  should  be  taken  in  AFCS  design  to  minimize  friction  and  inertia  con- 
tributed by  the  disengaged  AFCS  to  the  MFCS.  The  flying  qualities  specifica- 
tions set  limits  on  the  MFCS  which  must  be  satisfied  with  the  AFCS  disengaged. 
The  flying  qualities  specifications  also  specify  trim  rate,  trim  stall  and 
control  force  requirements  related  to  trim. 
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3.1, 3.6  Stability.  For  FCS  using  feedback  systems,  the  stability  as 
specified  in  3. 1.3. 6.1  shall  be  provided.  Alternatively,  when  approved  by 
the  procuring  activity,  the  stability  defined  by  the  contractor  through  the 
sensitivity  analyses  of  3. 1.3. 6. 2 shall  be  provided.  Where  analysis  is  used 
to  demonstrate  compliance  with  these  stability  requirements,  the  effects  of 
major  system  nonlinearities  shall  be  included. 

3.1. 3.6.1  Stability  margins.  Required  gain  and  phase  margins  about  nominal 
are  defined  in  Table  III  for  all  aerodynamlcally  closed  loop  FCS.  With 
these  gain  or  phase  variations  included,  no  oscillatory  instabilities  shall 
exist  with  amplitudes  greater  than  those  allowed  for  residual  oscillations 
in  3. 1.3. 8,  and  any  nonosc dilatory  divergence  of  the  aircraft  shall  remain 
within  the  applicable  limits  of  MIL-F-8785  or  MIL-F-83300.  AFCS  loops  shall 
be  stable  with  these  gain  or  phase  variations  included  for  any  amplitudes 
greater  than  those  allowed  for  residual  oscillations  in  3.1. 3.8.  In  multiple 
loop  systems,  variations  shall  be  made  with  all  gain  and  phase  values  in  the 
feedback  paths  held  at  nominal  values  except  for  the  path  under  investigation. 
A path  is  defined  to  include  those  elements  connecting  a sensor  to  a force 
or  moment  producer.  For  both  aerodynamic  and  nonaerodynamlc  closed  loops, 
at  least  6 db  gain  margin  shall  exist  at  zero  airspeed.  At  the  end  of  system 
wear  tests,  at  least  4.5  db  gain  margin  shall  exist  for  all  loops  at  zero 
airspeed.  The  margins  specified  by  Table  III  shall  be  maintained  under 
flight  conditions  of  most  adverse  center-of-gravity , mass  distribution,  and 
external  store  configuration  throughout  the  operational  envelope  and  during 
ground  operations. 
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GAIN  AND  PHASE  MARGIN  REQUlRLMliNTS  (dll,  DEGRI'l'-S) 


Mode 

Frequency  Hz 


fM  <0.06 


Airspeed 


> First  Aero- 
Klastic 
Mode 


1 

V 

"'MIN 

Below 

To 

At 

At 

^'MIN 

V 

^■*MAX 

Limit  Airspeed  (Vj_) 

1.15Vl 

GM  = -±4.5 

GM  = ±3.0 

GM  = 6 dB 

GM  - 0 

(No  Phase 
Requia’- 

PM  = ±30 

PM  = ±20 

PM  - 0 
(Stable 

meat 

II 

o 

GM  = ±4.5 

at 

Below 

Nominal 

V 

^MIN) 

PM  - ±45 

PM  = ±30 

Phase  and 

GM  = ±8.0 

GM  ±6,0 

PM  = ±60 

PM  - ±45 

1 

1 

where:  V.  ■ Limit  Airupeed  (MIL-A-886D) . 

L 

V ■ Minimum  Operational  Airspeed  i,  ■^T.-F-8785) . 

°MIN 


V " Maximum  Operational  Airspeed  O'llL-F-8785) . 

°MAX 


Mode  “ A characteristic  aeroelastic  response  of  the  air- 

craft as  described  by  an  aeroelastic  character- 
istic root  of  the  coupled  aircraft/FCS  dynamic 
equa  t ion-o  f -mo  t ion . 

GM  ■ Gain  Margin  ■ The  minimum  change  in  loop  gain,  at  nominal 

phase,  which  results  in  an  instability  beyond 
that  allowed  as  a residual  oscillation. 


PM  ■ Phase  Margin  ■ The  minimum  change  in  phase  at  nominal  loop  gain 

which  results  in  an  instability. 

f_  ■ Mode  frequency  in  Hz  (PCS  engaged). 

M 

Nominal  Phase  and  - The  contractor’s  best  estimate  or  measurement 

Gain  of  FCS  and  aircraft  phase  and  gain  character- 

istics available  at  the  time  of  requirement 
verification.  (2) 

3. 1.3. 6. 2 Sensitivity  analysis.  Tolerances  on  feedback  gain  and  phase  shall 
be  established  at  the  system  level  based  on  the  anticipated  range  of  gain  and 
phase  errors  which  will  exist  between  nominal  test  values  or  predictions  and 
in-service  operation  due  to  such  factors  as  poorly  defined  nonlinear  and 
higher  order  dynamics,  anticipated  manufacturing  tolerances,  aging,  wear, 
maintenance  and  noncritlcal  material  failures.  Gain  and  phase  margins  shall 
be  defined,  based  on  these  tolerances,  which  will  assure  satisfactory  opera- 
tion in  fleet  usage.  These  gain  and  phase  toleravices  shnll  be  established 
based  on  variations  in  system  characteristics  either  anticipated  or  allowed 
by  component  or  subsystem  specification.  The  contractor  shall  establish, 
with  the  approval  of  the  procuring  agency,  the  range  of  variation  to  be  con- 
sidered based  on  a selected  probability  of  exceedance  for  each  type  of 
variation.  The  contractor  shall  select  the  exceedance  probability  based  on 
the  criticality  of  the  flight  control  function  being  provided.  The  stability 
requirements  established  through  this  sensitivity  analysis  shall  not  be  less 
than  50  percent  of  the  magnitude  and  phase  requirements  of  3. 1.3. 6.1. 

DISCUSSION 


The  gain  and  phase  margin  definitions  listed  are  commonly  used  within 
flight  control  technology,  and  are  not  the  classical  definitions  found  in 
most  textbooks.  These  margins  are  both  positive  and  negative.  A negative 
gain  variation  (reduction)  can  lead  to  Instability  on  a basically  unstable 
airframe  which  relies  on  the  feedback  system  for  dynamic  stability.  Positive 
and  negative  phase  margins  denote  the  amount  of  lag  and  lead  that  may  be 
added,  respectively,  before  instability  occurs. 


The  margins  3peciii.^>d  vary  with  frequency.  These  margins  can  be  deter- 
mined  using  classical  Analysis  techniques,  adjusted  for  known  non- 

linearities.  Nortiu!lj.y  in  test  a lower  frequency  mode  will  set  the  test 
margins,  and  gain  margins  at  higher  frequencies  will  be  unobservable.  Con- 
sequently, compliance  with  these  gain  and  phase  margin  requirements  will 
likely  be  demonstrated  through  analysis  in  most  procurements. 

Figure  3D  Illustrates  a typical  FCS  block  diagram.  Several  feedback 
loops  are  shown;  however,  only  one  feedback  path  is  shown,  since  only  one 
sensor  and  one  moment  producer  are  Involved.  Thus,  only  one  control  path 
exists  and  only  one  stability  requirement  applies. 

Stability  margins  are  required  for  FCS  to  allow  for  variations  in  system 
dynamics.  Three  basic  types  of  variations  exist: 

Math  modeling  and  data  errors  in  defining  the  nominal  system  and 
plant. 

Variations  in  dynamic  characteristics  caused  by  changes  in  environ- 
mental conditions,  manufacturing  tolerances,  aging,  wear,  noncriti- 
cal  material  failures,  and  off-nominal  power  supplies. 

Maintenance  Induced  errors  in  calibration,  installation  and  adjust- 
ment . 

Most  low  frequency  math  nK)deling  errors  can  be  adjusted  out  during 
ground  or  flight  tests  to  obtain  the  desired  nominal  operating  characteristics. 
At  high  frequencies,  math  modeling  errors  are  difficult  to  Identify  and  com- 
pensate for  during  testing  due  to  the  approximations  used  to  Implement  opera- 
tional mockups,  the  limited  amount  of  flight  test  time  available  and/or  the 
limitations  of  instrumentation  commonly  used.  In  addition  to  the  variations 
caused  by  the  factors  listed  above,  variations  may  exist  due  to  usage  of  an 
Inadequate  number  of  flight  conditions  for  a given  analysis  or  flight  test 
program.  Within  the  industry,  flight  control  synthesis  is  normally  accom- 
plished using  equations-of-motion  defining  aircraft  and  system  characteristics 
at  selected  points  on  the  flight  envelope  in  various  aircraft  configurations. 
Flight  testing  is  also  normally  concentrated  at  a limited  number  of  points 
within  the  flight  envelope.  Selection  of  the  number  and  type  of  flight  con- 
ditions to  be  used  is  an  individual  decision  in  each  procurement. 

Another  source  of  variations  occurs  following  completion  of  the  aircraft 
development.  Following  initial  fleet  usage,  most  aircraft  experience  a series 
of  minor  modifications  to  improve  airplane  operating  characteristics.  These 
modifications,  which  typically  result  in  quite  minor  configuration  changes  on 
an  individual  basis,  can  result  in  significant  changes  in  flight  control 
stability  margins  as  modifications  are  accumulated  through  several  years. 

The  original  flight  control  system  design  should  allow  for  a degree  of  such 
variations,  such  that  FCS  modification  is  not  needed  following  all  aircraft 
modifications. 
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ACTUATOR  AIRPLANE 

DYNAMICS  DYNAMICS 


gure  3D.  Typical  FCS  Block  Diagram 


The  Intent  of  including  effects  of  major  nonllnearltlcs  In  analyses 
used  to  demonstrate  compliance  is  to  insure  that  adequate  margins  are 
retained  with  the  systems  operating  both  in  the  linear  and  nonlinear  range. 
Most  FCS  exhibit  rate  limiting  nonlinearities  with  large  control  surface 
amplitudes  at  higher  frequencies.  Deadband  or  hysteresis  is  also  usually 
present.  Where  linear  analysis  techniques  such  as  root  locus  are  used, 
phase  and  gain  characteristics  for  the  feedback  elements  operating  at  small 
perturbations  should  be  considered  to  evaluate  nonlinearities  such  as  break- 
out deadzones  or  hysteresis  and,  separately,  phase  and  gain  characteristics 
for  feedback  elements  operating  at  medium  and  large  control  surface  ampli- 
tudes should  be  conslderec  to  evaluate  the  near  linear  case  and  the  rate 
limiting  case.  Where  simulation  is  used,  these  nonlinearities  can  be 
included  directly  and  evaluated  by  measuring  frequency  responses  at  different 
control  surface  amplitudes.  The  contractor  may  choose  to  use  both  linear 
analyses  and  nonlinear  simulation  techniques  to  demonstrate  compliance  with 
these  requirements,  since  the  linear  analysis  approach  normally  provides  a 
better  representation  of  aeroelastic  effects  and  the  simulation  approach 
normally  is  superior  for  nonlinear  evaluations. 

The  math  models  to  be  used  for  these  stability  analyses  will  vary  with 
each  procuremen*; . The  contractor  will  determine  what  math  model  complexity 
is  required  for  each  procurement  and  should  include  this  model  description 
in  the  FCS  Development  Plan  (A.4.1). 

The  gain  and  phase  margins  specified  are  in  the  range  of  values  used  in 
previous  successful  procurements,  and  are  considered  the  minlmums  which  will 
provide  largely  trouble  free  service  during  fleet  usage.  Reference  48  recom- 
mends the  6 dB  zero  airspeed  requirement  and  provides  a discussion  of  NASA 
ground  and  flight  testing  of  stability  augmentation  systems.  Reference  49 
recommends  a 12  dB  requirement. 

Margins  are  specified  for  aerodynamlcally  closed  loops  and  nonaerody- 
namlc  loops.  An  aerodynamic  loop  is  one  which  relies  on  aerodynamics  for 
loop  closure  such  as  a stability  augmentation  or  .\FCS  loop.  Nonaerodynamic 
loops  do  not  rely  on  aerodynamics  for  loop  closure.  An  example  is  a servo- 
actuator  loop. 

A recommended  practice  for  higher  frequency  modes  is  to  gain  stabilize 
all  modes  (+180  degrees  phase  nargln) . A feedback  signal  attenuation  of  at 
least  second  order  beyond  the  actuator  second  order  frequency  is  also 
commonly  used.  Reference  50,  for  example,  used  a 180  degrees  phase  margin 
criteria  beyond  5 Hertz. 

An  example  of  problems  encountered  in  the  past  with  nonaerodynamic  loop 
stability  is  the  B-52  stick  steering  AFCS.  During  ground  testing  of  the  A/A 
42G-11  AFCS  a 4,2  Hertz  instability  was  encountered  in  the  pitch  control 
system.  This  problem  occurred  the  first  time  the  equipment  was  installed  in 
B-52  60-002  and  resulted  in  a 4.2  Hertz  unstable  oscillation  of  the  control 
column  which  would  build  up  until  an  automatic  disconnect  occurred  through 
the  overpower  circuit.  This  problem  was  eliminated  by  attenuating  the  loop 
gain  near  4.2  Hertz  through  filter  modification  and  relocation  of  the  pitch 
force  transducer.  To  avoid  such  problems,  a stability  analysis  of  the 
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nonaerodynanic  loops  should  ba  acconplishad  with  coluon  Inertia,  feel 
system  characteristics  and  other  MFCS  parameters  properly  modeled.  In 
some  applications  the  pilot  may  couple  with  the  system  and  pilot  mass  or 
inertia  may  have  to  be  included  in  the  analysis.  The  full  range  of 
excursions  expected  in  service  should  be  simulated  or  otherwise  analysed, 
especially  wheie  breakout  dead  sones,  hysteresis,  and  rate  limiting 
result  in  significant  nonlinear  system  characteristics. 

Reference  6 documents  a sensitivity  analysir  performed  to  establish 
gain  and  p:\.  se  m i^gin  criteria  required  to  accommodate  tolerances  in  the 
structur. ti < ;U'  icles.  Similar  analyses  can  be  used  to  determine  stability 
margins  ar  .<<il  frequencies  for  a given  procurement  based  on  the  inaccuracies 
anticipated  in  the  parameters  and  modeling  technique  used  and  based  on  the 
depth  of  analyses  planned  to  investigate  off-nominal  conditions  and  the 
effects  of  wear  and  aging. 

The  stability  margins  specified  vary  in  size  with  mode  frequency  and 
airspeed.  The  reduction  in  margin  at  reflects  a willingness  to  accept 
reduced  stability  and/or  performance  while  flying  outside  the  operational 
envelope.  The  increased  margins  at  higher  frequencies  reflect  needs  based 
upon  the  decreasing  accuracy  of  state-of-the-art  modeling  and  testing  tech- 
niques at  higher  frequencies. 

3. 1.3. 7 Operation  in  turbulence.  In  Operctional  State  I,  while  flying  in 
the  following  applicable  random  and  discrete  turbulence  environment,  the  PCS 
shall  provide  a safe  level  of  operation  and  maintain  mission-accomplishment 
capability.  For  essential  and  flight  phase  essential  controls,  at  least 
Operational  State  III  shall  be  provided  in  the  specified  flight-safety  turbu- 
lence levels.  Noncritical  controls  shall  provide  at  least  Operational  State 
i;  in  turbulence  up  to  the  intensities  specified  in  3. 1.3. 7.1.  Noncritical 
controls  operating  in  turbulence  at  intensities  above  the  specified  turbu- 
lence level,  shall  not  degrade  flight  safety  or  mission  effectiveness  below 
the  level  that  would  exist  with  the  control  Inactive.  Either  manual  or 
automatic  means  to  inactivate  the  control  for  flight  in  heavy  turbulence  may 
be  used,  when  required.  Hie  dynamic  analysis  or  other  means  used  to  satisfy 
this  requirement  shall  Include  the  effects  of  rigid  body  motion,  significant 
flexible  degrees  of  freedom  and  the  flight  control  system.  Significant 
nonlinear  effects  shall  be  represented  by  conservative  nonlinear  or  equiva- 
lent linear  representations. 

3. 1.3. 7.1  Random  turbulence.  The  RMS  turbulence  Intensity  to  be  used  for 
normal  flight  and  for  terrain  following  snail  have  a cumulative  probability 
of  exceedance  as  shown  in  Table  IV.  Table  V defines  RMS  vertical  gust  ampli- 
tude versus  altitude  for  selected  exceedance  probabilities.  The  relation- 
ship among  vertical,  lateral  and  longitudinal  RMS  intensities  and  scales  as 
specified  in  MIL-F-8785  shall  be  used  to  establish  intensities  for  lateral 
and  longitudinal  gusts.  The  listed  turbulence  intensity  levels  apply  at  the 
turbulence  penetration  airspeed,  Vq.  At  the  maximum  level  flight  airspeed, 

Vjj  these  intensity  levels  are  reduced  to  38  percent  of  the  specif iced  levels. 
The  mathematical  forms  of  continuous  random  turbulence  to  be  used  in  con- 
junction with  the  specified  intensity  levels  are  as  specified  in  MIL-F-8785 
and  the  airspeeds  cited  are  as  specified  in  MIL-A-8860. 
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tabu;  IV 

TURBULENCl-  INTENSITY  EXCEEDANCE  PROBABILITY 


ECS  RukUoiT''^^ 

MIL-E-8785 

MIL-E-8785 

Criticality 

Class  III 

Class  1,  II  & IV 

Essential 

10‘*' 

lO*'"* 

Flight  Phase  Essential 

_Ll0'<’ 

J_10*^ 

T 

T 

Noncritical 

10*- 

o 

1 

where:  T » The  longest  tine  spent  in  essential  flight  phaje 

segment  in  any  mission/ total  flight  time  per 
mission.  (3) 

3.1.3. 7.2  Discrete  gusts.  Discrete  gust  amplitudes  to  be  used  shall  be 
established  using  the  relationship  between  random  and  discrete  gust  ampli- 
tudes in  accordance  with  MIL-F-8785,  and  the  RMS  amplitudes  specified  in 
3. 1.3. 7.1.  The  1-cosine  discrete  gusts  defined  by  MIL-F-8785  shall  be 
applied  with  wavelengths  tuned  to  provide  maximum  excitation. 

DISCUSSION 

Turbulence  levels  are  specified  in  terms  of  exceedance  probabilities 
and  FCS  function  criticality.  Exceedance  probabilities  are  stationary 
probabilities  as  opposed  to  the  nonstationary  probabilities  used  in  relia- 
bility analyses.  See  the  discussion  under  3.1.2.11.2.2  for  a discussion  of 
the  difference.  For  essential  controls,  the  airplane  turbulence  penetration 
capability  may  be  set  by  the  structural  length  of  the  airframe,  the  augmen- 
tation capability  of  control  system,  or  a combination  of  the  two.  Reference 
51  describes  recent  incidents  in  large  jet  transport  operation  where  «omc 
loss  of  longitudina  . control  occurred  in  heavy  turbulence.  The  search  for 
the  cause  of  these  1. cidents  has  centered  on  possible  effects  of  severe 
turbulence,  such  as  structural  vibration  of  the  pilot’s  cockpit  which  limit 
the  pilot's  ability  to  read  instruments  or  the  possibility  of  pilot  disorien- 
tation due  to  apparently  conflicting  indications  from  his  instruments,  com- 
bined with  unusual  motion  sensations.  Reference  52  also  tabulated  and 
discussed  recent  accidents  caused  by  severe  turbulence.  This  paper  concludes 
that  the  main  hazard  is  loss  of  control  followed  by  structural  breakup  during 
recovery  attempts.  The  author  pointed  out  that  the  cost  of  turbulence  to 
DOD  operations  is  difficult  to  evaluate,  but  estimated  costs  for  the  three 
year  period  of  1963-65  at  $30,000,000  for  DOD  aircraft  loss  and  damage. 

Most  noncritical  controls  do  not  affect  turbulence  penetration  capabil- 
ity and  the  noncritical  controls  designer  is  primarily  concerned  with  main- 
taining acceptable  performance  in  terms  of  pilot  relief  or  ride  quality  while 
in  turbulence.  Noncritical  systems  such  as  ride  smoothing  systems  may  be 
designed  to  permit  saturation  in  moderate  turbulence  while  maintaining  a 
reduced  level  of  ride  Improvement.  Many  pilot  relief  AFCS  modes  are  commonly 


A9 


FLIGHT 

SEGMFNT 


TERRAIN 

FOLLOWINC 


NORMAL 

FLIGHT 


CRUISE 

AND 

DESCENT 


I Am  E V 

RMS  c.usr  INTI  Nsmi  s Km  si  li cri  lu  umui  ativi 

EXt  I • DANCI  l‘ROBABILITH  S.  I T'S*  ' TAS 


ALTITUDE 
(FI  A('.L) 


UP  TO  1000 
(VERTICAL) 


500 


1.750 


.1.750 


7.500 


15,000 


25.000 


55.000 


45,000 


55,000 


65,000 


75.000 


OVER 

80.000 


PROBABILITY  Ol 

I .XC  EEDANCl 

2 

Bsai 

10‘- 

10‘-' 

10*^ 

10'^ 

ur'’ 

4.0 

5.1 

K.O 

10.2 

12.1 

14.0 

2.5.1 

.5.5 

4.4 

7.0 

8,0 

10.5 

12.1 

17.5 

.5.2 

4.2 

6.6 

8.6 

11.8 

15.6 

18.7 

2 2 

3.(> 

6.0 

0.6 

1.5.0 

17.6 

21.5 

1.5 

.5..5 

7.4 

10,6 

16,0 

2.5.0 

28.4 

0 

1.6 

6.7 

10.1 

15.1 

2.5.6 

30.2 

0 

0 

4.6 

8.0 

11.6 

22.1 

30.7 

0 

0 

6.6 

0.7 

20,0 

31.0 

0 

0 

0.4 

5.0 

8.1 

16.0 

25.2  i 

0 

0 

0 

4.2 

8.2 

15.1 

23.1 

0 

0 

0 

2.7 

7.0 

12.1 

17.5 

0 

0 

0 

0 

4.0 

7.0 

10.7  ] 

1 

0 

0 

0 

0 

.5.2 

6,2 

8.4  I 

0 

0 

0 

0 

2.1 

5.1 

7.2  I 

1 

disengaged  when  turbulence  Is  encountered.  Reference  53  describes  a study 
to  determine  the  optimum  AFCS  mode  configuration  for  flight  in  severe  turbu- 
lence. This  study  recommends  engaging  the  roll  and  yaw  attitude  hold  modes 
with  system  gains  considerably  reduced  for  turbulence  penetration.  All 
pitch  modes  and  the  Heading  Hold  mode  should  be  disengaged,  based  on  this 
study.  However,  it  Is  Important  to  avoid  Inadvertent  automatic  mode  disen- 
gagement In  light  turbulence. 

T'.;e  turbulence  intensities  for  essential  end  flight  phase  essential 
controls  are  Intended  to  result  In  control  systems  capable  of  operating  at 
least  a minimum  safe  (Operational  State  III)  condition  in  the  maximum  turbu- 
lence Intensity  which  the  structure  can  penetrate  without  exceeding  limit 
load.  The  turbulence  intensities  specified  for  noncritical  controls  art  much 
lower  than  those  defined  for  essential  controls  and  are  correlated  with  the 
mission  accomplishment  probability  specified  for  an  individual  procurement. 

The  Flutter  Mode  Control  System  designed  for  the  B-52  CCV  flight  demon- 
stration (Reference  23)  was  required  to  operate  in  turbulence  with  an  exceed- 
ance probability  of  10”^. 

MIL-F-9A90C  required  AFCS  to  be  designed  for  a tuned  discrete  gust  of 
40  ft/sec  amplitude.  The  system  function  specified  was  limited  to  damping 
only  and  no  requirement  was  placed  on  manual  FCS.  This  requirement  is  stated 
in  terms  of  minimum  safe  operation  (Operational  State  III)  for  essential  con- 
trols and  in  terms  of  restricted  operation  (Operational  State  II)  for  non- 
critical controls.  Changes  in  system  damping  ratios,  frequencies  and  other 
characteristics  caused  by  system  saturation  in  turbulence  are  permitted 
providing  the  specified  operational  states  are  maintained.  Stability  augmen- 
tation systems  can  often  tolerate  substantial  displacement  saturation  and 
some  rate  saturation  while  maintaining  a reduced  level  of  performance. 
Noncritical  controls,  which  must  be  designed  fall-safe  (3. 1.3. 2),  can  often 
tolerate  severe  displacement  saturation. 

Control  system  rate  limiting  must  be  emphasized  for  FCS  controlling  an 
unstable  airframe,  since  rate  limiting  as  well  as  displacement  can  cause  loss 
of  stability.  The  procedure  used  for  the  American  SST  design,  see  Reference 
12,  was  to  rely  on  simulation  studies  to  establish  the  allowable  actuator 
minimum  rate  requirements.  The  design  condition  was  piloted  flight  in  heavy 
turbulence  at  landing  approach.  These  minimum  rate  requirements  were  less 
than  the  common  criterion  of  providing  stop-to-stop  surface  travel  in  one 
second.  After  the  minimum  rate  requirements  were  established,  it  was  veri- 
fied that  the  system  could  provide  these  minimum  rates  under  any  combinations 
of  failures  which  would  still  allow  at  least  minimum  safe  control. 

Reference  54  describes  a method  for  predicting  the  performance  of  the 
total  pilot-vehicle  system  for  command  tracking  and  altitude  hold  tasks  in 
turbulence.  This  method  is  based  on  pilot  model  theory  and  prediction  of 
tracking  errors.  The  validity  and  accuracy  of  this  method  has  been  ascer- 
tained by  means  of  moving  base  simulation  and  the  contractor  may  want  to  use 
a similar  method  to  comply  with  this  requirement. 

Reference  55  includes  an  excellent  discussion  of  the  current  state-of-the- 
art  in  understanding  the  problem  of  flight  safety  in  turbulence.  The  author 
points  out  that  control  has  been  an  important,  and  perhaps  critical  factor  in 
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recent  turbulence  related  aircraft  losses.  It  was  noted  that  commercial 
transports  have  been  estimated  to  spend  between  0.01  and  0.1  percent  of 
their  flight  time  In  thunderstorms,  despite  the  high  priority  given  to 
storm  avoidance.  Mountain  waves  are  also  a serious  flight  safety  problem 
and  have  resulted  in  aircraft  loss.  Clear  air  turbulence,  although  quite 
common,  is  not  generally  considered  a flight  safety  problem. 

The  Reference  55  study  emphasized  that  turbulence  normally  occurs  in 
patches  and  recommends  a five-mile  wide  patch  for  simulation.  Reference  52 
indicates  an  average  patch  duration  of  approximately  one  minute  for  moderate 
to  severe  turbulence  for  world-wide  civil  aircraft  operation.  The  turbulence 
requirements  of  this  specification  should  be  evaluated  using  the  turbulence 
patch  approach,  although  the  length  of  the  patch  may  be  selected  by  the  con- 
tractor as  either  less  or  greater  than  five  miles,  depending  on  the  mission 
requirements  of  the  procurement. 

The  specified  turbulence  intensity  levels  are  r'duced  in  magnitude  as 
airspeed  is  incre.  ed  beyond  the  turbulence  penetra'  i airspeed.  This  pro- 
cedure is  based  on  the  precedent  of  the  MIL-S-8861  gust  load  requirement  and 
similar  FAA  requirements  which  allow  similar  reductions  at  speeds  above  the 
gust  penetration  airspeed. 

The  anar.ytical  form  for  turbulence  mathematical  models  specified  in 
MIL-F-8785  are  referenced  for  use  in  flight  controls  analyses.  The  major 
diffe.;ence  between  the  turbulence  requirements  of  MIL-F-9490  and  MIL-F-8785 
is  in  the  required  intensity  levels.  The  requirements  of  MIL-F-8785  are 
restricted  to  flying  qualities  and  are  generally  more  lenient  than  those 
specified  in  this  specification.  The  turbulence  intensity  requirements  speci- 
fied herein  for  essential  and  flight  phase  essential  systems  are  based  on 
safety  considerations  with  a prime  objective  to  retain  minimum  safe  operation 
in  any  environment  the  structure  may  be  expected  to  penetrate. 

The  curves  shown  in  Figure  4D,  which  illustrate  the  probabilities  tabu- 
lated in  Table  V,  were  established  u.sing  the  following  relationship: 


where 

P(^^)  = cumulative  probability  that  will  equal  or  exceed 

a given  level.  ® 

^ = root  mean  square  value  of  gust  velocity  relative  to 

® the  airplane  body  axis,  ft/sec  TAS. 

= proportion  of  flight  time  spent  in  nonstorm  turbu- 
lence at  a given  altitude. 

P,  = proportion  of  flight  time  spent  in  storm  turbulence 

at  a given  altitude. 
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and 


Values  of  P,  , ?2*  ^2  taken  from  MIL-A-008861A.  Table  V lists 
values  of  RMS  turbulence  intensities  for  various  exceedance  probabilities, 
altitudes  and  flight  segments. 


3. 1.3. 7. 3 Wind  model  for  landing  and  takeoff.  The  following  wind  model 
form  shall  be  used  for  automatic  navigation  and  all  weather  landing  system 
design  as  required  by  3. 1.2. 9 and  3.1.2.10.  This  model  applies  for  low 
altitude  approach  and  landing  flight  phases  at  conventional  airports  and 
shall  not  be  applied  at  heights  greater  than  500  feet  above  mean  runway 
level. 


3. 1.3. 7. 3.1  Mean  wind.  The  probability  of  occurrence  of  total  mean  wind  and 
mean  crosswind  components  as  shown  on  figure  2 as  a function  of  wind  speed 
in  knots  as  measured  at  a reference  altitude  of  20  feet  above  mean  surface 
level. 


3. 1.3. 7. 3. 2 Wind  shear.  Wind  shear  shall  be  included  in  each  simulated 
approach  and  landing  inless  its  effect  can  be  accounted  for  separately.  The 
magnitude  of  the  shear  is  defined  by  the  expression 


.46  U logjQ(Z)  + .4  U 


where 


U 

Z 


mean  wind  at  height  Z feet  in  feet /sec (true) 
mean  wind  at  20  feet  in  feet/sec  (true) 
height  above  ground  (feet) 


(4) 


3. 1.3. 7. 3. 3 Wind  model  turbulence  The  longitudinal  wind  component  (in  the 
direction  of  the  mean  wind)  and  vertical  and  lateral  wind  components  shall 
each  be  represented  by  a Gaussian  process  having  a spectral  density,  I (/J.  ) 
of : 
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and  the  value  for 


= RMS  turbulence  level  in  an  axis  in 
= Scale  length  in  an  axis,  feet 
= Spatial  frequency  in  radians/ft. 
and  L is  shown  on  Table  VI. 
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WIND  SPEED  - (KNOTS,  INDICATED) 


Figure  2.  Cumulative  probability  of  reported  meaji  wind 
and  cross  wind  when  landing 


TABLE  VI 


RMS  TURBULENCE  LEVEL  AND  SCALE  LENGTH  BY  AXIS 


Vertical 

Lateral 

Longitudinal 

a 

0.1  U 

0.2  U 

0.2  U 

L 

1 5 Ft  for  Z ^ 30  Ft 

600  Ft 

600  Ft 

.5  Z Ft  for  30  Z < 1000 

1000  Ft 

DISCUSSION 

The  wind  model  currently  adopted  for  MIL~F-9490D  is  based  on  the  model 
described  in  British  Civil  Air  Regulations  (BCAR)  paper  367,  Issue  3,  January 
1970,  The  criteria  leading  to  adoption  of  this  model  are; 

It  most  nearly  fits  the  spectral  power  density  curve  of  observed 
winds  compared  to  any  other  analytical  model  presently  in  use. 

Correlative  data  comparing  in-service  aircraft  performance  with 
lab  data  is  available. 

The  model  is  easily  simulated  by  digital  or  analog  equipment  and 
requires  only  a moderate  amount  of  memory  or  analog  equipment. 

New  more  comprehensive  wind  models  are  currently  under  study,  but  it  is 
reasonable  to  expect  that  they  will  not  be  incorporated  into  MlL-F-9490  until 
such  time  as  they  have  been  demonstrated  to  comply  with  the  criteria  stated 
above.  Incorporating  untried  models  would  only  serve  to  destroy  a consistent 
baseline  of  comparison  between  modern  military  and  civil  aviation  systems 
along  with  the  benefits  accruing  from  such  comparisons. 

The  wind  model  defined  is  intended  for  use  in  approach,  landing  and  take- 
off simulation.  It  is  specifically  a low  altitude  model  and  should  not  be 
relied  on  for  altitudes  above  500  feet  above  mean  surface  level.  The  model 
has  been  modified  from  that  in  the  referenced  BCAR  paper  to  reflect  a wind- 
reporting  height  of  20  feet  above  the  surface.  This  modification  brings  the 
model  in  line  with  American  tower  reporting  procedures. 

The  wind  shear  defined  in  3. 1.3. 7 .3. 2 is  based  on  the  consideration  that 
in  neutrally  stable  air,  the  wind  profile  between  10  feet  and  300  feet  above 
the  surface  may  be  given  by 


Ku 


In^  or  u = 
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where 


K ••  von  Kerman  constant  - 0.4 

u ■ wind  velocity  at  height  Z above  the  surface 

u*  ■ friction  velocity,  considered  to  be  a constant  up  to  a 

height  of  at  least  300  feet  above  the  surface 

Z ■ aerodynamic  roughness  height  (0.15  feet  for  terrain 
typical  of  airfields) 

Larger  wind  shears  can  occur  In  convectlonally  stable  conditions 
(essentially  laminar  flow)  which  usually  occur  at  night  with  mean  wind  speeds 
less  than  20  feet/second.  However,  the  circumstances  are  less  severe  since 
the  associated  turbulence  will  be  less  than  the  levels  given  In  3. 1.3. 7. 3. 3. 

In  conditions  of  roughly  neutral  atmospheric  stability,  the  rms  of  the 
horizontal  wind  speed  fluctuations  1s  close  to  0.20  U ft/sec.  (U  Is  the 
20-foot  reported  wind  In  feet/sec.)  for  terrain  typical  of  airfields  and  It 
can  be  taken  as  Independent  of  height  from  10  ft.  up  to  at  least  300  ft.  In 
unstable  conditions  the  rms  Is  likely  to  be  relatively  larger  (up  to  0.33  U), 
while  In  stable  conditions  lower  rms  values  occur,  down  to  almost  zero.  For 
mean  wind  speeds  greater  than  30  ft/sec.,  atmospheric  stability  is  likely  to 
be  nearly  neutral. 

In  conditions  of  nearly  neutral  atmospheric  stability,  ever  a range  of 
wavelengths  from  300  ft.  to  3,000  ft.,  the  spectral  density  of  the  horizontal 
gusts  behaves  as  the  k^^  power  of  wavelength,  where  k varies  with  height, 
between  above  1.4  at  100  ft.  and  1.1  at  10  ft.  At  altitudes  above  100  ft., 
k approaches  1.67  and  is  approximately  equal  to  this  value  at  wavelengths 
shorter  than  300  ft.  at  all  heights.  Adequate  data  Is  not  available  for 
definite  statements  to  be  made  about  the  behavior  of  the  spectral  density  at 
wavelengths  longer  than  3,000  ft,  but  it  would  be  reasonable  to  assume  that 
it  is  constant.  The  model  defined  in  3.1. 3. 7. 3. 3 is  chosen  to  give  agreement 
with  the  measured  data  for  wavelengths  between  about  300  ft.  and  5,000  ft. 

(see  Figures  5D  and  6D). 

In  the  Gaussian  process  model,  changes  In  longitudinal  wind  velocity  over 
an  arbitrary  distance  have  a Gaussian  distribution.  Although  giving  an  ade- 
quate description  of  measured  wind  decreases,  the  Gaussian  model  underesti- 
mates the  probability  of  large  wind  Increases.  In  adopting  the  Gaussian  model, 
the  consideration  is  made  that  critical  aircraft  performance  parameters  are 
most  significantly  influenced  by  wind  decreasing. 

Data  on  vertical  gusts  below  300  ft.  above  the  surface  in  strong  winds 
(in  excess  of  30  ft/sec)  is  much  less  extensive  than  it  Is  for  horizontal 
gusts.  Available  information  is  that  the  rms  of  turbulence  intensity  is 
about  one-half  that  of  the  horizontal  component.  The  spectral  density  appears 
closer  to  the  form  given  in  3. 1.3. 7. 3. 3 than  that  of  the  horizontal  gusts. 
However,  the  scale  length  varies  significantly  with  height  as  indicated  by 
the  table  of  parameters  in  3. 1.3. 7. 3. 3. 


57 


SPECTRAL  DENSITY  OF  HORIZONTAL  WIND6PEED  FLUCTUATION 
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Figure  5D.  Mean  smoothed  spectrum  at  lOO  ft.  height  compared  with  model 
spectra  having  the  same  RMS  and  various  values  of  scale  lengths 


Figure  6D . Mean  smoothed  spectra  for  six  1 hour  runs,  fitted  to  give  same 
spectral  density  at  short  wave  lengtlis 
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In  unstable  conditions,  particularly  In  the  presence  of  cumulo  nimbus 
or  well  developed  cumulus  clouds,  large  and  rapid  fluctuations  In  wind 
speed  and  direction  occur  which  are  apparently  unrelated  to  the  mean  speed 
or  direction  of  the  wind  before  their  occurrence,  which  is  usually  light 
and  seldom  greater  than  30  ft/sec.  These  large  and  rapid  fluctuations  are 
not  represented  xn  the  gust  model  of  3. 1.3. 7. 3. 3.  The  model  spectra  provide 
a good  prediction  of  large  gusts  associated  with  winds  stronger  than  30  ft/ 
sec  on  an  annual  basis.  But,  the  model  significantly  underestimates  larg- 
est annual  gusts  associated  with  lighter  winds.  For  example,  the  probability 
of  large  gusts  associated  with  a mean  wind  speed  of  15  ft/sec  are  predicted 
to  be  about  half  of  the  observed  value. 

3. 1.3. 8 Residual  oscillations.  For  normal  operation  and  during  steady 
flight,  FCS  induced  aircraft  residual  oscillations  at  all  crew  and  passenger 
stations  shall  not  exceed  O.OAg's  vertical  or  0.02g's  lateral  peak  to  peak 
acceleration.  Residual  oscillations  In  pitch  attitude  angle  shall  satisfy 
the  longitudinal  maneuvering  characteristic  requirements  of  MIL-F-8785. 
Residual  oscillations  in  roll  and  yaw  attitude  at  the  pilot's  station  shall 
not  exceed  0.6  degree  peak  to  peak  for  flight  phases  requiring  precision 
control  of  attitude. 

DISCUSSION 

These  residual  oscillation  requirements  apply  to  both  manual  and  auto- 
matic FCS  under  normal  conditions  These  limits  do  not  apply  to  failure 
states  such  as  FCS  Operational  States  below  State  I.  The  amplitudes  speci- 
fied correspond  roughly  to  the  percept ILle  level.  There  is  some  disagreement 
in  the  literature  on  the  exact  level  of  perception.  Different  researchers 
have  established  slightly  different  perception  levels  based  on  using  differ- 
ent teat  environments  and  test  subjecv's.  Perception  level  also  varies  with 
frequency.  Reference  24,  for  example,  lists  results  of  low  frequency  moving 
base  testing  which  suggests  low  frequency  perception  levels  roughly  25 
percent  below  those  specified  for  normal  acceleration.  However,  in  general, 
the  amplitudes  specified  should  prove  acceptable  in  general  military  usage. 

MIL-F-8785  Includes  pitch  axis  residual  oscillation  requirements  in 
general  terms  with  a O.lOg  maxim'jm  cited.  These  requirements  are  more 
specific  and  include  all  axes.  The  intent  of  this  requirement  is  to  prohibit 
FCS  residual  oscillations  which  can  be  detected  by  the  crew. 

The  angular  attitude  oscillation  requirement  is  based  on  tracking 
accuracy  concerns.  Little  or  no  data  is  available  to  substantiate  the  limits 
specified,  which  are  double  the  previous  MIL-F-9490C  limits.  Roll  residual 
oscillations  of  0.7  degree  have  been  reported  for  the  AWACS  airplane  without 
crew  complaint.  Reference  13  recommends  +0,5  degrees  of  1.0  degree  peak  to 
peak  as  the  roll  attitude  limit  for  commercial  transport  design.  Residual 
oscillations  in  pitch  attitude  and  heading  are  also  limited  to  +0.25  degree 
or  0.5  degree  peak  to  peak.  These  higher  values  are  acceptable  for  flight 
phases  not  requiring  precision  control  of  attitudes.  In  procurements  having 
stringent  tracking  accuracy  requirements,  residual  oscillations  will  likely 
be  reduced  even  below  the  limits  specified  to  obtain  desired  performance. 
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Residual  oscillatory  surface  deflection  limits  of  O.S  degree  peak  to 
peak  to  take  care  of  equipment  wear  considerations,  as  well  as  crew  dis- 
comfort should  be  considered  based  on  the  conclusions  of  Reference  48. 

3. 1.3. 9 System  teat  and  monitoring  provisions.  Test  and  monitoring  means 
shall  be  incorporated  Into  the  essential  and  flight  phase  essential  FCS  as 
required  to  meet  the  following  requirements  of  this  specification: 

Mission  Reliability  3.1.6 

Flight  Safety  3.1.7  to  3. 1.7.1 

Fault  Isolation  3.1.10.2  to  3.1.10.2.2 

Failure  Immunity  & Safety  3. 1.3. 2 to  3.1. 3.2.1 
Survivability  3.1.8  to  3. 1.8.1 

Invulnerability  3.1.9  to  3. 1.9. 7 

The  effect  of  detected  and  undetected  FCS  failures  taken  with  the  probabil- 
ity of  occurrence  of  such  failures  shall  comply  with  the  system  reliability 
and  safety  requirements.  This  requirement  shall  Include  all  failures,  both 
active  and  latent,  and  failures  In  all  components  of  the  system.  Including 
mechanical,  electrical  and  hydraulic  components. 

3. 1.3. 9.1  Bullt-In-Test  equipment  (BIT).  The  total  maintenance  aid  testing. 
Including  BIT,  and  inflight  monitoring  where  used,  shall  provide  an  inte- 
grated means  of  fault  Isolation  to  the  LRU  level  with  a confidence  factor 

of  90  percent  or  greater.  BIT  functions  shall  have  multiple  provisions  to 
ensure  they  cannot  be  engaged  in  flight.  The  test  equipment  shall  not  have 
the  capability  of  Imposing  signals  which  exceed  operating  limits  on  any 
part  of  the  system  or  which  reduces  Its  endurance  capability  or  fatigue  life. 
Ground  test  signals  shall  not  be  of  sufficient  magnitude  to  drive  actuators 
Into  hard-stop  limits. 

3. 1.3. 9. 1.1  Preflight  or  pre-engage  BIT.  Preflight  or  pre-engage  BIT  may  be 
automatic  or  pllot-lnltlated,  and  Includes  any  test  sequence  normally  con- 
ducted prior  to  takeoff  or  prior  to  engagement  of  a control  to  provide  assur- 
ance of  subsequent  system  safety  and  operability.  It  should  be  demonstrated 
that  redundant  MFCS  electronic  channels  are  operating  normally  without  any 
safety-critical  latent  failures  prior  to  takeoff.  This  Includes  all  backup 
or  normally  disengaged  channels,  and  fault  monitoring  and  failure  Isolation 
elements.  The  preflight  tests  shall  not  rely  on  special  ground  test  equip- 
ment for  their  successful  completion.  Any  test  sequence  which  could  disturb 
the  normal  activity  of  the  aircraft  In  a given  mode  shall  be  Inhibited  when 
that  mode  Is  engaged. 

3. 1.3. 9. 1.2  Maintenance  BIT.  Where  required,  BIT  shall  also  be  provided  as 
a postflight  maintenance  aid  for  the  FCS  BIT  shall  be  designed  to  avoid 
duplicating  test  features  included  as  prrt  of  the  preflight  test  or  monitor- 
ing functions. 

3. 1.3. 9. 2 Inflight  monitoring.  Continuous  monitoring  of  equipment  perform- 
ance and  critical  flight  conditions  shall  be  active  as  a minimum,  during 
essential  or  flight  phase  essential  modes  of  operation.  False  monitoring 
warnings,  including  the  automatic  or  normal  pilot  response  thereto,  shall  not 
consltute  a specific  hazard  in  excess  of  the  system  reliability  requirements. 
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DISCUSSION 


Aa  flight  control  systems  become  more  complex,  system  test  takes  on 
greater  Importance  as  a means  for  improving  safety,  assuring  mission  success 
and  reducing  maintenance  costs.  Reference  56  suggests  methods  for  reducing 
unscheduled  and  no-defect  maintenance  and  inflight  malfunctions  of  PCS  used 
in  high  performance  aircraft  such  as  the  F-14.  This  work  was  based  on  the 
finding  that  the  actuators  are  the  most  troublesome  PCS  components  to  main- 
tain and  present  methods  of  detecting  and  isolating  PCS  malfunctions, 
inflight  and  preflight,  are  inadequate. 

The  total  test  and  monitoring  capability  necessary  for  essential  and 
flight  phase  essential  PCS  has  been  defined  in  terms  of  two  broad  categories, 
inflight  monitoring  and  ground  functions  (BIT).  The  rationale  supporting 
two  categories  lies  in  the  objectives  for  each.  Inflight  and  preflight 
functions  comprise  those  tests  and  monitoring  systems  necessary  to  assure 
compliance  with  system  safety,  survivability.  Invulnerability  and  reliabil 
ity  requirements  called  out  in  3. 1.3. 9.  Assurance  of  operational  compliance 
with  the  ground  rules  used  to  determine  reliability,  safety,  survivability, 
and  invulnerability  may  demand  that  ways  be  provided  to  check  operational 
states.  The  arrangement  and  implementation  of  test  and  monitoring  circuitry, 
and  the  equipment  or  flight  conditions  checked  by  the  inflight  and  preflight 
functions  should  be  selected  to  ensure  compliance  with  these  requirements. 

Ground  test  functions  (BIT)  are  defined  in  order  to  achieve  an  acceptable 
level  of  maintainability  and  may  rely  on  special  preconditions  or  ground 
equipment  to  augment  the  tests.  Consequently,  in  order  to  avoid  significant 
impact  on  system  reliability  through  complexity,  it  is  necessary  to  minimize 
the  equipment  dedicated  to  Bj.f  before  reaching  the  point  of  diminishing 
returns  wliere  the  majority  of  the  BIT- identified  faults  are  malfunctions  of 
the  BIT  equipment.  For  this  reason,  the  most  feasible  comprehensive  mainten- 
ance aid  philosophy  is  an  integration  of  the  capabilities  of  the  inflight, 
preflight  and  ground  test  functions  with  a prohibition  against  duplication 
of  functions. 

The  test  and  monitoring  systems  may  comprise  any  one  or  combination  of 
the  following  functions: 

Continuous  In-Line  Monitoring  - Concerns  monitoring,  techniques 
incorporated  in  digital  computer  software  to  verify  the  integrity  of  that 
computer . 


Tracer  Monitor  - Used  in  analog  computers  to  verify  that  an  ampli- 
fier or  similar  circuit  will  pass  a particular  test.  It  can  also  be  used  to 
verify  the  presence  of  an  a-c  excitation  voltage. 

Status  Monitor  - Monitors  the  status  signal  from  another  channel 
or  other  source. 

Comparison  Monitor  - Commonly  called  a comparator.  Can  compare 
across  channels,  across  voters  or  a channel  to  a model. 

Sequential  Off-Line  Monitor  - Used  to  test  in-air,  off-line  sub- 
systems . 
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Standard  Comparator  - A stimulus  of  known  value  inserted  into 
a unit  under  test  and  the  response  compared  against  a standard. 

Logic  Test  - An  Interrogation  or  comparison  of  logic  devices  to 
determine  the  actual  state. 

Preflight  and  Inflight  testing  and  monitoring  are  essential  to  safe 
•‘peratlon.  The  functions  to  be  monitored  and  in  part,  the  monitoring 
methods,  will  be  the  result  of  analyses  and  studies  to  be  made  along  with 
the  system  design.  Certain  requirements  or  criteria  may  be  established 
as  essential  to  a safe  system.  These  should  include  the  following: 

All  active,  and  most  passive  failure  should  be  detected. 

The  comparator  limits  and  trip  times  should  be  great  enough  to 
prevent  nuisance  disconnects. 

Failure  transients  should  be  less  than  a sa?  specified  g level, 
see  3. 1. 3. 3.4 . , 

Noncritlcal  passive  failures  may  be  detected  by  BIT  or  ground 

test,  and 


The  system  reliability  should  be  high  enough  to  make  the  proba- 
bility of  two  similar  critical  passive  failures  virtually  nil  during  one 
flight . 

The  capability  of  the  IFM  to  detect  and  disengage  faults  is  directly 
related  to  flight  safety  requirements  and  pilot  confidence  in  the  system. 
An  IFM  should  he  capable  of  detecting 

Any  failure  whicli  degrades  performance  below  the  system  specifi- 
cation requirements. 

Monitoring  circuitry  failures  which  could  mask  failures  of 
functional  circuitry,  and 

Single  failures  which  could  cause  loss  of  aircraft  control  if 
combined  with  another  subsequent  failure. 

Additionally,  a low  nuisance  trip  rate  is  desirable  if  pilot  confi- 
dence is  to  be  maintained  in  failure  indications.  A nuisance  trip  rate 
should  be  selected  which, 

Assures  pilot  confidence  in  the  system  by  not  crying  "wolf" 
frequently,  or  disengaging  the  system  during  critical  phases  of  the 
mission. 


Requires  selection  of  failure  threshold  settings  which  reflect 
true  primary  failures  as  defined  above. 

Keeps  failure  transients  from  being  excessive,  i.e.,  too  wide  a 
failure  threshold  setting,  and 
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Keeps  the  system  from  always  being  in  a failed  state,  i.e.,  too 
tight  a failure  threshold  setting. 

Preflight  tests  for  essential  and  flight  phase  essential  PCS  should 
be  provided  to  enable  the  pilot  to  determine  whether  or  not  the  safet)^ 
critical  portions  of  the  PCS  are  functioning  properly.  It  should  be 
demonstrated  that  redundant  MPCS  electronic  channels  are  operating  normally 
without  any  safety-critical  latent  failures  prior  to  takeoff.  Depending 
on  the  dispatch  rules  used  in  calculating  flight  safety  reliability,  the 
pilot  may  need  to  know  the  operational/failure  state  channel  by  channel 
and  axis  by  axis.  This  includes  all  backup  or  normally  disengaged  chan- 
nels. Pilot  operated  preflight  check  requirements  should  be  integrated 
into  the  PCS,  and  not  require  use  of  ground  test  equipment.  It  should 
be  possible  to  perform  preflight  tests  by  manipulation  of  the  following 
equipment : 


The  PCS  preflight  test  means  of  activation. 

The  aircraft  control  stick  or  wheel. 

The  aircraft  control  pedals. 

The  controls  on  the  PCS  control  console. 

Plaps  and  speedbrake  controls,  etc. 

Results  of  the  preflight  tests  should  indicate  to  the  pilot  the  proper 
functioning  of  the  PCS  as  it  may  affect  system  safety.  The  test  provisions 
should  Include  the  capability  for  determining  the  Integrity  of  the  following: 

The  control  paths  between  pilot's  control  input  and  the  aircraft 
power  contl'ol  units. 

MPCS  feedback  sensors  and  control  paths. 

MFCS  fault  monitoring  and  failure  Isolation  systems  for  sensors, 
electronics,  and  servosy stems . 

The  manual  trim  systems. 

They  should  also  be  able  to  determine  the  functional  capability  of  the 
following  in  their  fail-operational  modes: 

Electronic  computation  and  control  paths  to  PCS  secondary  actu- 
ators, excluding  sensors. 

Fault  monitoring  and  failure  isolation  system  for  sensors,  elec- 
tronics, and  servosystems. 

Additional  test  capability  for  checking  the  command  limiting  and  struc- 
tural protection  systems  should  be  provided.  The  test  provisions  should  be 
mechanized  to  enable  the  pilot  to  complete  all  preflight  tests  in  less  than 
two  minutes  after  war aup  time.  Test  equipment  should  not  have  the  capa- 
bility of  imposing  signals  which  exceed  operating  limits  on  any  part  of  the 
system  or  which  reduce  its  wear  capability  or  fatigue  life. 
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BIT  is  Incorporated  in  the  PC'S  as  a maintenance  aid  and  comprises  two  '« 

major  activities: 

Maintenance  Preflight  - A crew  chief  activated  test  directed  to 
detection  of  faults  without  regard  to  location  and  run  on  internal  APU  or 
battery  power  to  avoid  engine  operation. 

Maintenance  Fault  Isolation  ~ A maintenance  activated  test  dir- 
ected specifically  to  maintenance  troubleshooting. 

Criteria  for  an  operational  BIT  system  should  include: 

Elimination  of  Aerospace  Ground  Equipment  (AGE)  required  in 
addition  to  normal  flight  line  AGE  to  perform  preflight  and  routine  main-  ! 

tenance  checks, 

Elimination  of  personnel  in  addition  to  normal  ground  crew 
required  in  order  to  perform  the  BIT  operation,  and 

Testing  comprehensive  enough  to  assure  safe  aircraft  mission 
completion.  j 

Design  to  provide  positive  disengagement  in  flight  and  personnel 
and  equipment  safety  during  ground  operation. 

In  discussions  with  airlines  maintenance  managers,  such  as  at  the  annual  ’ 

Avionics  Maintenance  Conference,  they  indicate  mixed  feelings  about  BIT.  Many 
have  stated  that,  in  general,  BIT  is  ineffective  and  has  caused  more  problems 
than  it  has  solved  (too  many  false  alarms);  and,  in  many  cases,  they  are  dis- 
connecting the  BIT  circuits  and  painting  over  the  bullseyes  or  removing  them 
to  increase  reliability.  On  the  other  hand,  in  the  case  of  Category  III 
triple-redundant  autoland  systems,  they  find  that  they  need  BIT  to  maintain 
the  complex  equipment . 

This  experience  should  be  seriously  considered.  It  should  be  recognized 
that  self-test  capability  will  be  required  on  many  of  the  new  systems  which 
are  evolving,  but  that  it  should  not  be  imposed  across  the  board  for  all  sys- 
tems. In  many  cases,  other  methods  are  adequate,  more  reliable  and  more 
economical.  Some  BIT  systems  require  circuitry  which  equals  or  exceeds  the 
complexity  of  the  circuits  being  tested  and  can  degrade  overall  reliability, 
or  reduce  effectiveness  of  the  aircraft  because  of  erroneous  fault  indica- 
tions . 

3.1.4  MFCS  design.  The  following  requirements  apply.  References  to  mech- 
anical or  electrical  MFCS  apply  only  when  the  mechanization  is  used; 

j 

a.  Augmentation.  When  used,  augmentation  systems  shall  be  compatible 
with  all  control  modes  and  airframe  dynamic  considerations.  Single  failures 
in  a gain  scheduling  system,  not  classed  as  extremely  remote,  shall  not 
degrade  augmentation  system  performance  belcw  Operational  State  II.  Pilot- 
operated  gain  changing  devices  shall  only  be  used  as  emergency  backup  equip-  i 

ment.  Specific  approval  shall  be  obtained  from  the  procuring  activity  for 
this  feature.  Positive  mechanical  or  electrical  stops  shall  be  provided  in 
gain  schedulers  to  preclude  exceeding  limiting  gain  values. 
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b.  Ratio  changing  mechanisms  Where  ratio  '-hanging  mechanisms  are 
used,  monitors  and  emergency  positioning  means  shall  be  provided  if  improper 
positioning  can  result  in  a safety  of  flight  hazard. 

c.  Control  centering,  breakout  forces  and  free  play.  The  corresponding 
design  requirements  of  MIL-F-8785  or  MIL-F-83J00  shall  be  met.  Selected 

SL  .sitlvity  and  breakout  forces  shal!  not  le;id  to  overcont rol  tendencies. 

d.  Reversion . If  a backup  mode  is  provided  for  a flight  control  system 
at  least  FCS  Operational  State  III  shall  be  provided  following  reversion. 

While  disengaged,  interaction  of  backup  mode  provisions  with  the  normal  mode 
.shall  not  degrade  operation  below  State  1.  If  a single  FCS  power  systen  is 
used  in  an  essential  or  flight  phase  essential  fully  powered  system,  emer- 
gency rnechauical  reversion  or  an  emergency  pover  source  shall  be  providevi. 

On  single-engine  aircraft,  the  emergency  power  source  shall  be  independent 
of  engine  operation.  It  shall  oe  possible  to  re-engage  the  normal  powir 
source  in  flight  following  operation  with  manual  reversion  controls  or 
emergency  power.  Manual  or  automatic  changeover  to  or  from  emergencv  pro- 
visions shall  not  resvilt  In  capability  worse  than  FCS  Opi;rational  State  III. 

e.  Controller  kinematics.  Kinematics  shall  preclude  hazardous  uninten- 
tional inputs  (crosstalk)  into  one  or  more  axes  with  normal  control  motions 
vr'thin  the  limits  of  ultimate  structural  load  factor,  design  maneuver,  and 
turbulence  induced  accelerations  experienced  at  the  crew  station. 

f.  Feedback  co  crew  station  controls.  The  control  dcivice  motion  a.'d 
force  required  to  accomplish  stability  and  control  augmentation  shall  not  be 
evident  at  the  cre.w  station  control.s.  Vibratory  forces  or  motion  acting  upon 
elements  downstreun  of  the  controller  shall  not  be  evident  at  the  crew 
station  controls.  Force  and  motion  feedback  to  crew  station  controls  shall 
be  considered  as  not  evident  if  the  foi'ce  magnitude  is  less  ti.an  half  the 

lo  ;est  breakect  force  of  the  applicable  control. 

DISCUSSION 

Performance  requirements  for  MFCS  are  specified  in  3.1.1  by  reference  to 
applicable  specifications  and  general  design  rc>quirement s to  be  satisfied  by 
all  FCS  arc  del'ined  in  3.1.3. 

Wliere  augmenrat  ioii  systems  are  tjsed , the  operatben  in  turbulence  require- 
ments of  3. 1.3. 7 are  irpcu'tauf  co  ).s  Idora  t ions  rnd  should  be  considered  early 
in  tlie  design  process, 

The  680-J  program  (References  49  and  57)  investigated  the  need  for 
multiple  modes,  one  or  more  of  wh’ch  exists  se.ely  for  the  purpose  of  provid- 
ing a backup  for  the  primary  mode.  The  Mechanical  Back-  Up  (MBU)  and  F.lectrl- 
cal  Back-Up  (EBU)  modes  included  in  the  680-J  Survlvable  Flight  Control  System 
(SFCS)  fall  into  this  cacegory.  The  MBU  mode  ceused  some  degradation  of  the 
pitch  normal  mode  stai'llitv  ’■•roperties  at  low  amolitudes.  This  was  attributed 


If  an  EBU  mode  Is  Included  In  a future  design  it  should  not  be  allowed 
to  significantly  degrade  the  normal  mode  of  operation.  For  some  applications, 
inclusion  of  either  an  MBU  or  EBU  would  be  useless,  as  in  a case  where  the 
unstable  nature  of  an  aircraft  may  preclude  control  with  a simple,  open  loop 
control  system.  Unless  a clear  need  for  an  open  loop  backup  mode  can  be 
established,  none  should  be  provided  in  a production  system.  A better 
approach  would  be  to  strengthen  the  primary  mode  at  those  points  where  weak- 
nesses tend  to  justify  an  EBU. 

3. 1.4.1  Mechanical  MFCS  design.  In  the  design  of  mechanical  components, 
the  reliability,  strength  and  simplicity  of  the  system  shall  be  paramount 
considerations.  The  signal  transmission  between  the  pilot's  controls  and 

the  control  surfaces  shall  be  redundant  to  the  extent  required  to  meet  relia- 
bility, failure  immunity,  invulnerability  and  other  requirements  of  this 
specif ication. 

3. 1.4. 1.1  Reversion  - boosted  systems.  In  the  mechanic.'!  vei  sion  mode,  at 
least  FCC  Operational  State  III  shall  be  provided.  The  normal,  boosted, 
contro]  forces  shall  provide  FCS  Operational  State  I.  It  shall  be  possible 
to  re-engage  boost  following  operation  with  mechanical  reversion. 

DISCUSSION 

These  requirements  for  mechanical  MFCS  apply  only  where  mechanical 
implementation  is  utred.  The  level  of  mechanical  redundancy  to  be  used  is 
determined  by  failure  immunity,  reliability,  survivability  and  invulnera- 
bility characteristics  required  for  individual  procurements. 

For  fully  powered  MFCS  on  multiple  engine  aircraft,  emergency  power 
requirements  may  be  determined  by  the  invulnerability  to  engine  failure 
requirements  of  3. 1.9. 4. 

3. 1.4. 2 Electrical  MFCS  design.  Electrical  flight  control  systems  (6.6) 
shall  be  designed  with  special  consideration  to  invulnerability  to  light- 
ning strikes  and  to  the  thermal,  EMI  and  other  induced  environments  of 
3.1.9. 3. 

DISCUSSION 

Major  progress  in  developing  Electrical  Flight  Controls  has  been  made  in 
recent  years.  Reference  58  discus.-ses  integration  of  hybrid  electrical- 
mechanical  systems  and  presents  a somewhat  unique  design  approach  to  raechan.^e 
a hybrid  system.  This  concept  features  the  u.se  of  aerodynamic  summing  to 
separate  the  electrical  and  mechanical  signal  transmission  paths. 

Reference  59  describes  some  of  tho  problems  encountered  in  designing  the 
USA  SST  control  augment  .tion  system.  A four  channel  system  using  mechanical 
voting  with  a separate  mechanical  backup  FCS  w.ns  used  to  transmit  pilot 
commands . 
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the  USA  SST.  The  impact  of  failure  immunity  and  invulnerability  considera- 
tions is  also  described  '"or  this  application.  Reference  61  describes  design 
and  flight  experience  with  a digital  electrical  flight  control  system  on  an 
F-8  aircraft.  A sampled  data  design  synthesis  example  is  Included  which 
demonstrates  the  roll  of  various  analytical  and  s'^mulation  methods.  This 
effort  revealed  that  verification  of  digita^  flight  control  software  requires 
an  extensive  effort,  which  should  not  be  underestimated.  Use  of  an  iron 
bird  simulation  was  considered  Indispensable  for  a development  of  this  nature. 
A lesson  learned,  and  an  inherent  consideration  in  electrical  flight  control, 
is  the  need  to  replace  the  slop  normally  present  in  a mechanical  system  with 
some  equivalent  electrical  deadband  in  the  pilot's  input  path.  Reference  62 
makes  the  point  that  Control  Configured  Vehicle  and  electrical  flight  control 
concepts  are  interrelated  and  points  out  increased  capabilities  obtained  with 
the  F-4  flight  test  aircraft. 

Reference  60  concludes  that  safety  and  survivability  requirements  as 
opposed  to  mission  reliability  requirements  may  dictate  the  complexity  of  an 
electrical  MFCS.  Problem  areas  such  as  sensor  accuracy  and  alignment  con- 
trol and  display  panel  cockpit  real  estate  limitations  and  lightning  strike 
susceptibility  are  discussed. 

The  680- J program  (References  49  and  57)  and  the  American  SST  program 
both  found  the  growth  of  complexity  encountered  during  design  of  complex 
flight  controls  to  be  a problem.  The  basic  simplicity  and  pure  separation 
obtained  through  aerodynamic  summing  should  be  seriously  considered  in  the 
future.  A basic  recommendation  of  the  680-J  program  was  to  eliminate  elec- 
tronic or  mechanical  voting  in  future  designs  when  the  aerodynamic  configur- 
ation permits  the  use  of  multiple  independent  surfaces  which  provide 
aerodynamic  summing.  Recent  developments  which  successfully  used  a form  of 
aerodynamic  summing  include  the  DC-10  and  the  B-52  CCV  flutter  mode  control 
system. 


3.]. 4. 2.1  Use  of  mechanical  linkages.  If  a separate  artificial  feel  system 
is  used,  or  if  mechanical  linkages  are  used  to  connect  a signal  conversion 
mechanism  with  the  control  surface  actuators,  friction  and  freeplay  shall  not 
result  in  FCS  operation  below  State  I.  Longitudinal  and  directional  controls 
shall  be  mass  balanced  in  the  fore  and  aft  direction  and  lateral  controls 
shall  be  provided  inboard  to  outboard  balance,  consistent  with  structural 
mode  and  longitudinal  force  requirements.  Any  residual  vertical  imbalance 
shall  be  consistent  with  feel  requir-^ ments . 

DISCUSSION 

Future  system  designs  may  utilize  a fixed  center  or  side  stick  or  a 
stick  to  which  the  feel  mechanism  is  directly  attached.  However,  if  a 
separate  aitificial  feel  system  is  required  it  should  be  located  as  near  to 
the  pilot's  control  stick  as  possible  to  minimize  the  use  of  mechanical 
linkage  which  produces  friction  and  freeplay.  Even  so,  680-J  program  flight 
testing  demonstrated  that  even  small  amounts  of  friction  and  freeplay  located 


friction  level  since  the  electrical  breakout  force  designed  into  the  elec- 
tronics must  be  equal  to  or  greater  than  the  sum  of  the  feel  breakout  and 
friction  forces.  Flight  testing  has  shown  that  the  pilot  has  cot.irol  dif- 
ficulty due  to  small  amplitude  instability,  when  the  airplane  responds  to 
controller  inputs  prior  to  movement  of  the  controller  itself.  However, 
the  electrical  breakout  force  cannot  be  allowed  to  exceed  the  mechanical 
breakout  of  the  feel  system  by  a large  margin  because  the  resulting 
controller  motion  will  appear  to  have  excessive  freeplay.  The  mechanical 
and  electrical  breakout  should  be  matched  as  closely  as  possible.  Tolerances 
should  be  specified  which  assure  that  the  electrical  breakout  will  be  the 
higher  of  the  two.  Freeplay  can  usually  be  reduced  by  using  precision 
bearings  at  the  expense  of  increasing  friction.  If  freeplay  producing  link- 
age cannot  be  avoided,  the  linkage  may  be  preloaded  by  springs  of  a high 
enough  force  level  to  eliminate  the  freeplay. 

Linkage  may  also  be  required  in  some  electrical  control  systems  in  which 
it  is  undesirable  to  incorporate  or  integrate  the  signal  conversion  mechanism 
into  the  surface  actuator.  The  output  of  the  servo  control  unit  v;ould  then 
operate  the  control  surface  actuators  through  mechanical  linkage.  Again,  the 
amount  of  mechanical  linkage  used  must  be  held  to  a minimum  to  minimize 
friction  and  free-play.  If  any  appreciable  amount  is  used,  precision  bearings 
and  system  preloading  again  should  be  considered.  At  this  point  in  the  system, 
friction  and  free-play  cause  Increased  phase  lag  during  closed  loop  operation 
which  could  result  in  noticeable  small  amplitude  limit  cycling. 

If  mechanical  linkage  must  be  incorporated  into  the  electrical  flight 
control  system  then  Inertial  balancing  becomes  ai’  important  design  parameter 
which  should  be  considered  during  the  design  stages.  Inertial  imbalance  of 
the  mechanical  linkage  may  produce  forces  which  can  be  felt  by  the  force 
sensing  device  of  the  electronics.  All  controller  mechanizations  will  require 
attention  to  kinematics  with  regard  to  applicable  vehicle  rates,  attitudes 
and  acceleraticiis  in  all  degrees  of  freedom.  For  example,  longitudinal  and 
directional  control  systems  will  require  mass  balancing  in  the  fore  and  aft 
direction  as  well  as  the  vertical  direction.  Lateral  systems  would  require 
inboard  to  outboard  balance  as  well  as  vertical  balance.  A stick  force 
and/or  position  proportional  to  normal  acceleration  may  be  desirable.  If  so, 
the  feel  system  should  include  the  desired  residual  imbalance.  See  Reference 
1 for  a detailed  discussion  of  bobweights,  control  balance  and  feel.  Initial 
design  of  future  electrical  control  systems  should  include  a means  of  altering 
the  mass  to  provide  system  balance  in  the  flight  test  airplane. 

3.1.5  AFCS  design.  AFCS  shall  be  provided  to  the  extent  specified  by  the 
procuring  ac' ivity. 

3. 1.5.1  S'^stem  requirements.  When  the  specified  modes  are  used,  the  follow- 
ing design  requirements  apply. 

3. 1.5. 1.1  Control  stick  (or  wheel)  steering.  If  this  mode  is  requi’  d, 
HIL-F-8785,  or  if  applicable,  MlL-F-83300,  shall  be  used  as  the  basis  for 
control  capability. 


3. 1.5. 1.2  Flight  director  subsystem.  If  common  mode  selection  is  used, 
it  shall  be  possible  to  select  control  stick  steering  with  flight  director 
operation  in  place  of  any  of  the  other  AFCS  modes.  Single-channel  flight 
director  operation  shall  be  possible  when  all  but  one  channel  of  a redundant 
system  has  failed. 

3. 1.5. 2 AFCS  interface. 


3. 1.5. 2.1  Tie-In  with  external  guidance.  Internal  FCS  switching  with  zero 
command  signal  input  from  external  guidance  systems  shall  not  cause  trans- 
ients greater  than  engage  transients  per  3. 1.5. 2. 3.  Noise  content  in  usable 
external  guidance  signals  shall  not  saturate  or  bias  any  component  of  the 
FCS,  shall  not  impair  the  response  of  the  aircraft  to  the  proper  guidance 
signals,  and  shall  not  cause  objectionable  control  motion  or  attitude  varia- 
tion. Steering  information  transmitted  to  the  AFCS  shall  be  compatible  with 
the  accuracy  and  dynamic  performance  requirements  of  the  guidance  loop.  The 
tie-in  provisions  shall  not  degrade  performance  of  other  subsystems  by  caus- 
ing excessive  loading  or  saturation. 

DISCUSSION 

Steering  information  may  be  transmitted  to  the  AFCS  by  analog  or  digital 
means.  For  digital  implementations,  sampling  frequency  and  number  of  bits 
per  signal  are  important  compatibility  considerations.  For  analog  data  links, 
gain  variation  and  zero  shift  of  the  data  link  should  be  considered  to  assure 
compatibility  with  guidance  loop  requirements. 

3. 1.5. 2. 2 Servo  engage  interlocks.  Interlocks  shall  be  provided  to  prevent 
servo  engagement  and  to  provide  disengagement  in  the  presence  of  conditions 
that  render  disengagement  safer  than  engagement.  Manual  override  of  inter- 
locks shall  be  provided  wherever  such  override  capability  will  enhance  flight 
safety. 


3. 1.5. 2. 3 Engage-Dlsengage  transients.  Normal  engagement  or  disengagement  of 
AFCS  modes  shall  not  result  in  transients  exceeding  the  limits  set  on  MFCS 
engage-disengage  transients  by  MIL-F-8785  and  MIL-F-83300.  Normal  engagement 
transient  requirements  shall  be  met  2 seconds  after  completion  of  any  maneuver 
up  to  the  maneuver  limits  of  the  aircraft  or  the  limits  of  sansor  equipment 
being  used. 

3 . 1 . 5 . 3 AFCS  emergency  provisions. 

3. 1.5. 3.1  Manual  override  capability.  It  snail  be  possible  to  manually 
overpower  or  countermand  the  automatic  control  action  of  the  AFCS  using  the 
normal  pilot  controls.  Required  pilot  forces  shall  not  exceed  pilot  capa- 
bilities as  defined  by  MIL-STD-1472.  The  overpower  force  for  V/STOL  aircraft 
and  helicopters  shall  not  exceed  the  limit  cockpit  control  forces  specified 
for  Level  1 operation  in  MIL-F-83300.  Manually  overriding  the  AFCS  shall 
not  result  in  an  instability  due  to  force  fight  between  the  pilot  and  the  AFCS. 


DISCUF'' 


The  purpose  of  manual  override  capability  is  to  allow  the  pilot  to 
immediately  respond  to  an  unforeseen  emergency  situation.  The  typical  maxi- 
mum forces  listed  below  for  override  are  consistent  with  modern  aircraft 
system  practices  and  have  been  shown  to  be  substantial  enough  to  prevent 
inadvertent  pilot  inputs  tu  the  control  surfaces  during  normal  automatic 
system  maneuvers. 

Single  channel  AFCS  operations  (single  servo  engaged) 


Rudder 

1 

00 

o 

pounds 

Elevator 

- 20 

pounds 

(stick) 

- 35 

pounds 

(wheel ) 

Aileron 

- 10 

pounds 

(stick) 

- 20 

pounds 

(wheel) 

Redundant  channel  AFCS  operations  (servos  engaged  in  a redundant 

configuration) 

Rudder  - 120  pounds 

Elevator  - 30  pounds  (stick) 

50  pounds  (wheel'' 

Aileron  - 15  pounds  (stick) 

30  pounds  (wheel) 

These  forces  are  also  adequately  limited  to  allow  pilou-initiated 
recovery  procedures  in  the  event  the  AFCS  misf unctions . The  pilot  has  the 
option  to  disengage  the  automatic  system  through  normal  disengagement  switches 
provided,  or  to  override  the  system  and  disengage  it  after  the  initial 
recovery  maneuver . 

Manual  override  for  EFCS  ("fly-by-wire")  does  not  necessarily  require 
mechanical  means.  The  electrical  command  authority  of  control  stick  steer- 
ing or  of  the  basic  EFCS  may  be  used  to  fulfill  this  requirement. 

For  override,  there  is  no  requirement  to  provide  a force  level  allowing 
the  pilot  to  precisely  control  aircraft  altitude  or  position.  It  is  expected 
that  override  will  be  used  to  initiate  a recovery  maneuver  followed  in  a 
short  time  by  manual  disconnect  or  disei*gagement  of  the  aueomatic  flight 
control  system. 

3. 1.5. 3.2  Emergency  disengagement.  Positive  emergency  means  of  disengage- 
ment, in  addition  to  norinal  mode  selection,  shall  be  provided  for  AFCS. 

The  emergency  disengagement  means  shall  also  ground  the  po\;er  input  side 
of  the  servo  engage  solenoids.  No  intervening  switching  mechanism  between 
the  point  of  ground  and  the  solenoid  shall  exist. 


DISCUSSION 


The  switching  mechanism  used  should  provide  a means  of  positively 
grounding  the  power  input  side  of  the  servo  engage  solenoids.  It  is  unlikely 
that  the  main  servo  engage  power  wire(s)  will  be  routed  up  to  the  flight  deck, 
then  down  to  the  solenoid,  particularly  on  transport  or  bomber  size  aircraft. 
Theretore,  the  cockpit  switches  may  incorporate  further  means  to  remotely 
apply  the  ground.  Consequently,  fail-safe  design  procedures  should  be  used 
for  any  supplementary  circuitry  to  insure  the  integrity  of  the  emergency 
disconnect  function. 

Servo  engage-disengage  solenoids  should  not  have  high  engage-dlsengage 
voltages  or  current  differentials.  For  example,  a nominal  28-volt  D.C.  sole- 
noid that  engages  at  26  volts  and  disengages  at  6 volts  is  less  desirable 
than  one  that  engages  at  18  volts  and  disengages  at  15  volts.  The  disengage 
circuit  configuration  should  he  carefully  designed  to  avoid  the  possibility 
of  ground  loop  voltages,  under  normal  and  plausible  failure  states  of  any 
interfacing  equipment,  causing  uncommanded  engagement  or  disengagement. 

Normal  operation  includes  effects  of  transients  such  as  lightning  currents. 

3.1.6  Mission  accomplishment  reliability.  Tue  probability  of  mission  fail- 
ure per  flight  due  to  relevant  material  failures  in  the  flight  control  sys- 
tem shall  not  exceed  the  applicable  limit  specified  below.  Failures  in 
power  supplies  or  other  subsystems  that  do  not  otherwise  cause  mission  fail- 
ure shall  be  considered  where  pertinent.  Each  mission  to  which  this  require- 
ment applies  shall  be  established  and  defined  by  the  contractor,  subject  to 
approval  of  the  procuring  activity. 


a.  Where  overall  aircraft  mission  accomplishment  reliability  is  specified 
by  the  procurement  activity, 

b.  Where  overall  aircraft  mission  accomplishment  reliability  is  not 

specified,  . < 1 x lO"^ 

M(fcs)  — 


where : 


q>^(fcs) 


Maximum  acceptable  mission  unreliability  due  to  relevant 
FCS  material  failures. 


Specified  overall  aircraft  mission  accomplishment 
reliability. 


M(fcs) 


Mission  accomplisnment  allocation  factor  for  flight 
control  (chosen  by  the  contractor).  (6) 


DISCUSSION 

See  discussion  under  3.1.7. 

3.1.7  Quantitative  flight  safety.  The  probability  of  aircraft  loss  per 
flight,  defined  as  extremely  remote,  due  to  relevant  material  failures  in 
the  flight  control  system  shall  not  exceed: 


^S(fcs)  ~ ^^"^S^^S(fcs) 


V * Flight  safety  allocation  factor  for  flight  control 
'■  ^ (chosen  by  the  contractor). 

Rg  ■ Overall  Aircraft  Flight  Safety  Requirements  as 

specified  by  the  procuring  activity.  (7) 

Failures  in  power  supplies  or  other  subsystems  that  do  not  otherwise  cause 
aircraft  loss  shall  be  considered  where  pertinent.  A representative  mission 
to  which  this  requirement  applies  shall  be  established  and  defined  in  the 
FCS  specification  (4.4.2).  If  overall  aircraft  flight  safety  in  terms  of  Rg 
is  not  specified  by  the  procuring  activity,  the  numerical  requirements  of 
table  VII  apply. 


TABLE  VII 

FCS  QUANTITATIVE  FLIGHT  SAFETY  REQUIREMENTS 


MAXIMUM  AIRCRAFT  LOSS 
RATE  FROM  FCS  FAILURES 

OVERALL  A/C 
FLIGHT  SAFETY 
REQUIREMENT 
NOT  SPECIFIED 
BY  PROCURING 
ACTIVITY 

MIL-F-8785 
CLASS  III  AIRCRAFT 

10-’ 

ALL  ROTARY  WING 
AIRCRAFT 

Qs(fcrt  <25  » 10-2 

MIL-F-8785  CLASS  I, 
II  & IV  AIRCRAFT 

Qs(fcs)^l»0  » If’ 

DISCUSSION  - ANALYSIS  CONSIDERATIONS 

Reliability  and  flight  safety  requirements  for  the  material  flight  con- 
trol system  (hardware  reliability  without  consideration  of  pilr>t  errors)  are 
specified  on  a probabilistic  basis  for  the  two  operational  levels  most  signif- 
icant to  the  aircraft  and  its  weapon  system  or  other  function;  l.e.,  flight 
safety  and  mission  accomplishment. 

A similar  reliability  requirement  is  included  in  MIL-F-8785B.  A single 
analysis  should  satisfy  both  requirements,  although  different  analysis  results 
will  apply  to  each  requirement.  Basic  differences  between  the  two  realibility 
requirements  are: 

MIL-F-8785B  takes  a worst  case  approach  and  assumes  a maximum 
mission  length  and  that  all  failures  occur  at  the  critical  point  in  the 
flight  envelope  (with  regard  to  flying  qualities).  Limits  arc  placed  on 
encountering  Level  2 and  Level  3 flying  qualities.  No  direct  requirement 
is  placed  on  mission  accomplishment.  See  Reference  1 for  a discussion  of 
this  requirement. 
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such  a failure  Is  critical.  Failures  associated  with  CCV  systems,  such  as 
ride  smoothing,  must  be  considered  where  the  function  provided  is  other  than 
flying  quality. 

Due  to  these  basic  differences  in  approach  to  specifying  reliability,  the 
numbered  values  cited  by  MIL-F-9490D  are  at  least  an  order  of  magnitude  more 
stringent  than  those  found  in  MIL-F-8785  if  one  compares  mission  accomplish- 
ment to  Level  1 flight  safety  to  Level  2.  However,  the  Intent  of  both  speci- 
fications appears  to  be  similar,  and  the  implementations  needed  to  satisfy 
the  flying  quality  requirement  should  be  similar  to  those  needed  to  satisfy 
the  flight  controls  requirement. 

The  flight  safety  analysis  should  consider  all  failure  modes  that 
threaten  flight  safety,  whether  single  failures  or  combinations  of  failures, 
and  whether  extremely  remote  or  not.  Likewise  the  mission  accomplishment 
reliability  analysis  should  consider  all  failure  modes  that  threaten  mission 
accomplishment,  whether  single  failures  or  combinations  and  whether  extremely 
remote  or  not.  It  should  not  be  Inferred  that  the  probability  of  aircraft 
loss  due  to  relevant  material  failures  in  the  FCS  is  identical  to  the  proba- 
bility of  experiencing  one  or  more  failure  modes  that  degrade  performance 
below  Operational  State  III.  Many  of  the  failure  modes  that  degrade  perform- 
ance below  State  III  will  be  critical  only  under  certain  unfavorable  combina- 
tions of  variables  such  as; 

Visibility  Conditions 

Turbulence  Levels 

Airspeed  or  Mach  Number 

Altitude 

Pilot  Warning  and  Reaction  Time 
Gross  Weight 

Center  of  Gravity  Location 

Thus  if  a given  failure  mode  will  result  in  aircraft  loss  only  under 
commbinations  of  the  above  variables  which  can  reasonably  be  expected  10  per- 
cent of  the  time,  a failure  probability  of  10“^  per  mission  will  contribute 
an  Increment  of  only  10”®  to  aircraft  loss  probability.  The  designer,  how- 
ever, must  beware  of  over  reliance  on  this  philosophy.  He  still  has  the 
responsibility  to  strive  to  eliminate  as  many  hazards  as  practicable, 
regardless  of  probability  and  avoid  dismissing  a potential  problem  with 
just  the  thought,  "Oh,  that  will  never  happen". 

Where  criticality  varies  with  mission  phase,  it  is  generally  necessary 
to  construct  a suitable  mathematical  model  for  each  critical  failure  mode. 

In  some  cases  it  may  be  necessary  to  distinguish  between  failure  modes  that 
are  hazardous  chiefly  at  the  time  of  occurrence  because  they  introduce  an 
element  of  surprise  and  require  1 -mediate  pilot  reaction,  and  failure  modes 
that  are  hazardous  chiefly  because  they  leave  the  system  in  a decraded 


An  FCS  Specification  should  be  prepared  by  the  contractor  (4.4.2), 
which  includes  the  intended  mission.  This  definition  should! 

Clearly  distinguish  between  wartime  safety  and  peacetime  safety. 
Different  rules  can  be  expected  for  operation,  dispatch,  maintenance,  etc. 

Define  abort  criteria  if  peacetime  safety  is  to  be  the  basis. 

To  a lesser  degree,  the  same  principles  may  sometimes  be  applied  to  the 
probability  of  mission  failure.  A failure  mode  that  degrades  performance 
below  State  II  does  not  necessarily  result  in  mission  failure.  All  the  per- 
tinent variables  must  be  taken  into  account  when  computing  the  increment  of 
mission  failure  probability  that  results  from  a given  probability  of  occur- 
rence of  each  specific  system  failure  mode. 

The  fact  that  a given  function  is  not  classed  as  essential  does  not 
necessarily  assure  that  all  the  failure  modes  of  the  associated  hardware  are 
noncritlcal.  Such  hardware,  even  if  its  basic  function  is  not  essential,  may 
have  dangerous  failure  modes  (hardover,  oscillatory,  divergent,  etc.)  that 
can  threaten  loss  of  aircraft.  The  flight  safety  analytls  must  Include  any 
such  modes,  in  addition  to  the  various  failure  modes  of  hardware  performing 
essential  or  mission-phase-essential  functions. 

The  flight  safety  analysis,  as  well  as  the  mission  accomplishment  relia- 
bility analysis,  must  take  into  account  the  failure  modes  of  monitoring  and 
self-test  subsystems,  to  whatever  extent  these  modes  can  impact  flight  safety 
or  mission  accomplishment  reliability.  Also  to  be  accounted  for  are  latent 
failure  modes  that  might  go  undetected  and  so  uncorrected,  even  with  operative 
monitoring  and  test  systems. 

Probabilities  of  component  failures  should  include  allowances  for  normal 
wearout  as  well  as  random  failure,  unless  it  Is  assured  that  the  assembly 
Involved  will  be  subject  to  scheduled  overhauls  at  intervals  sufficiently 
short  to  preclude  significant  wearout.  This  consideration  applies,  particu- 
larly to  hydraulic  seals,  bearings,  and  other  parts  that  are  typically 
replaced  in  scheduled  overhaul;  also  to  cooling  blowers  for  electronic 
equipment,  particularly  if  they  contain  brushes. 

Note  that  survivability  and  invulnerability  are  related  to  reliability 
but  are  specified  in  following  sections,  in  absolute  terms  rather  than  on  a 
probability  basis. 

DISCUSSION  - NUMERICAL  REQUIREMENT 

Concept 

Inn  a qualitative  sense,  the  probability  of  aircraft  loss  to  relevant 
material  failures  in  the  flight  control  systems  must  be  "extremely  remote", 
which  is  defined  as  the  probability  of  an  event  occurring  which,  although 


range  of  a wing  structural  failure  due  to  an  extreme  load  condition,  seizing 
or  binding  of  a high-force  hydraulic  actuating  cylinder,  or  the  simultaneous 
occurrence  of  two  or  more  statistically  Independent  failures,  the  individual 
probabilities  of  which  are  very  low.  For  this  specification  extremely  remote 
is  defined  (6.6)  as  numerically  equal  to  Qc/f  \*  the  specified  quantitative 
FCS  flight  safety. 

Flight  Safety  Requirement 

To  provide  a means  for  determining  compliance  with  the  requirement,  a 
numerical  value  must  be  established.  In  many  cases,  a flight  safety  require- 
ment for  the  overall  aircraft  or  weapon  system,  Rg,  will  be  specified  and  the 
maximum  allowable  probability  of  aircraft  loss  due  to  material  failures  in 
the  flight  control  system,  Qs(fcs)»  he  established  by  the  contractor 
based  upon  the  proportion  of  the  maximum  allowable  probability  of  aircraft 
loss,  due  to  all  material  failures,  which  is  allocated  to  the  flight  control 
system. 

A typical  division  or  budgeting  of  the  overall  allowable  loss  rate  is 
depicted  in  Figure  7D.  Using  a typical  value  of  As(fcs)"^ ‘ assuming 

a specified  flight  safety  requirement  for  the  overall  aircraft,  Rg»0.9999, 
then : 


Qs(fcs)  — (1-0.9999)  0.10  ^ .00001  losses/flight  or  no  more  than  one 
aircraft  loss  in  100,000  flights  due  to  material  failures  in  the  flight  con- 
trol system. 

In  budgeting  the  overall  allowable  loss  rate  into  system  allocations, 
the  interdependency  of  systems  must  be  recognized.  For  instance,  powered 
flight  control  systems  cannot  be  separated  from  the  hydraulic  and  electrical 
power  systems.  Where  dedicated  power  systems  are  used,  reliability  inter- 
faces must  be  established  and  such  failures  included  in  the  FCS  flight 
safety  evaluation. 

The  numerical  requirements  specified  for  use  in  cases  where  flight- 
safety  is  not  otherwise  specified  are  based  on  actual  Air  Force  field  safety 
experience  data,  such  as  documented  in  Reference  46  and  as  shown  in  Appendix 
A herein,  used  as  follows: 

For  MIL-F-8785  Class  III  aircraft,  field  safety  experience  data  for  the 
B-52,  C-135,  and  C-141  aircraft  were  examined;  and,  their  major  accidents 
(due  to  all  material  failures)  in  the  1964-1973  time  period  were  reported  to 
occur  at  rates  of  2,145/100,000,  0.846/100,000,  and  0.822/100,000  flights, 
respectively.  Of  these  accidents,  1.365  B-52  aircraft  were  destroyed  per 
100,000  flights,  0.363  C-135  aircraft  were  destroyed  per  100,000  flights, 
and  no  C-141  aircraft  were  lost.  Although  there  were  no  aircraft  lost  due 
to  material  failures  in  the  flight  control  system,  the  flight  control  system 
failure  which  resulted  in  a major  accident  of  a B-52  airplane  could  easily 
have  been  catastrophic,  and  therefore  the  combined  major  accident  rate  of 
0.055/100,000  flights  due  to  material  failures  in  the  flight  control  system 
was  adopted  as  representative  of  this  class  of  aircraft. 


X.  ALLOWABLE  LOSS  RATE 
FOR  OVERALL  AIRCRAFT 


Figure  7D.  Typical  division  of  overall  aircraft  allowable  loss  rate 
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For  MlL-F-8785  Classes  I,  II  & IV  aircraft,  field  sutety  experience  for 
the  F-A  was  examined,  and  their  nuijor  accidents  (due  to  all  material  fail- 
ures) in  the  same  10-year  period  was  found  to  be  3.158/100,000  flights.  Of 
these  accidents,  aircraft  were  lost  at  the  rate  of  2.378/100,000  flights. 

Of  these,  0.5A6  and  0.351  were  lost  per  100,000  flights  duo  to  flight  con- 
trols and  hydraulic  systems,  respectively,  for  a combined  rate  of  0.897/ 
100,000  flights,  which  was  rounded  off  and  adopted  as  representative  of 
this  class  aircraft. 

The  need  for  a higher  degree  of  reliability  for  M1L-F-8V85  Cless  III 
aircraft  is  self-evident  Inasmuch  as  there  are  often  no  provisions  for 
evacuating  personnel  in  flight  and/or  because  they  are  designed  to  carry 
nuclear  weapons  or  other  stores  or  equipment  which  must  be  recovered  if  at 
all  possible.  At  the  same  time,  a higher  degree  of  reliability  is  usually 
easier  to  accomplish  because  such  aircraft  are  generally  larger  and  can  more 
easily  accommodate  the  additional  redundancy  required.  In  addition,  the 
design  penalties,  weight,  and  cost  for  ejection  seats  or  escape  capsules, 
usually  provided  in  MIL-F-8785  Class  IV  aircraft,  are  not  usually  required 
for  Class  III  aircraft. 

For  rotary-wing  aircraft,  field  safety  experience  data  for  the  H-1,  H-3, 
H-A3,  and  H-.53  helicopters  were  examined.  Their  combined  major  accident 
rate  (due  to  all  material  failures)  was  found  to  be  1.826/100,000  flight.**. 

Of  these  accidents,  aircraft  were  destroyed  at  the  rate  of  1.345  per  100,000 
flights,  with  losses  due  to  failures  in  the  flight  control  system  and  hydrau- 
lic power  system  occurring  at  rates  of  0.192  and  0.096  per  100,000  flights, 
respectively.  These  combine  for  a rate  of  0.288  per  100,000  flights. 

In  calculating  the  predicted  reliability  of  any  given  fliglit  control 
system  to  show  compliance  with  the  stated  requirement,  it  must  be  recognized 
that  it  will  not  always  be  possible  to  determine  (on  the  actual  airplane) 
that  all  subsystems  and  components  are  failure-free  and  operable  at  the  cud 
of  preflight  check.  In  some  designs,  it  may  be  feasibie  to  check  for  com- 
plete freedom  from  failure  only  at  longer  maintenance  intervals.  In  those 
cases  it  will  be  necessary  to  design  to  a higher  reliability  to  compensate 
for  the  fact  that  daily  takeoffs  may  be  made  with  some  components  or  subsys- 
tems already  in  a failure  state.  See  Appendix  R for  metliods  of  determining 
reliability  increases  required  to  compensate  foi'  blind  redundancies. 

Mission  Accomplishment  Requiiement 

In  many  cases,  a mission  accomplishment  l el  iani  1 i t y rei|u i rement  for  the 
aircraft  or  weapon  systems,  R{.(,  will  be  specified  and  the  maximum  allowable 
probability  of  mission  failures  due  to  material  failures  in  the  flight  con- 
trol systems,  established  by  the  contractor  based  upon  the 

proportion  of  the  maximum  allowable  probability  of  mission  failure,  due  to 
all  material  failures,  which  is  allocated  to  the  flight  control  system.  A 
typical  mission-ac compl isluuent  reliability  requirement  lor  an  .iiccraft  weapon 
system  might  be  0.99  per  mission,  corresponding  to  .i  maximum  allowable  mis- 
sion failure  rate  of  0.01  per  mission.  For  this  case,  a typical  value  of 
^M(fcs)’  be  0.10  resulting  In  a maximum  allowable  mission  failure  rate, 

due  to  relevant  material  failures  in  the  flight  control  systems,  of  0M(f,;g) 

001  -inV.,-  i-\-v  t-T.-.n  I, no  ,n  ■in  lOflO  fl  ^l^t, 
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Kov  other  aircraft  which  are  dependent  upon  a large  number  of  complex 
onboard  equipment  to  achieve  mission  accomplishtaent , such  as  an  airborne 
warning  and  command  syrtem  aircraft  possessing  a large  and  complex  avionics 
system,  a lower  mission-accomplishment  reliability  requirement  such  as  0.90 
might  be  appropriate.  For  this  case,  however,  A^j(fcs)»  might  he  as  low  as 
0,01  since  a much  greater  proportion  of  the  allowable  failures  would  be 
allocated  to  the  avionics  equipment.  However,  in  this  particular  example, 
^Mffcs)  flight  control  systems  Is  again  ^ .001  aborts/flight 

(l.e.,  Qm(<:cs)  ^ (0.90)(.01). 

Therefore,  in  view  of  these  possibilities,  the  maximum  allowable  rate 
of  .001  or  1 mission  abort  per  1000  flights  due  to  materinl  failures  in  the 
flight  control  system  as  established  for  use  in  cases  where  a specific  mis- 
sion accomplishment  reliability  requlrn’ent  is  not  specified  by  the  procuring 
activity. 

References  47  and  63  also  provide  pertinent  background  Information. 
Riiference  47  reports  on  a study  which  documents  reliability  experience  on 
naval  tactical  aircraft.  Reference  63  describes  unique  features  of  the  B-1 
FCS  and  discusses  the  flight  safety  and  mission  accomplishment  reliability 
budgets  establisiied  for  the  R-1  fliglit  control  system.  The  B-1  ICS  was 
designed  with  an  allowable  mission  failure  rate  due  to  FCS  failures  of  1 per 
1034  flights  according  to  Reference  63.  References  59  and  12  document  the 
design  of  the  USA  SST  flight  controls.  Very  string'.nt  reliability  goals  were 
adopted  for  this  system  and  the  last  prediction  prior  to  SST  contract  cancel- 
lation showed  loss  rates  in  the  range  of  10"®  per  mission.  The  design 
criteria  adopted  and  a discussion  of  some  of  the  problems  encountered  is 
presented.  An  important  conclusion  of  this  development  wan  that  reliability 
calculations  are  really  only  applicable  to  a system  that  har  had  the  design 
errors  worked  out  oi  it.  Reliability  calculations  are  nsetn!  for  determining 
the  better  of  several  design  approaches,  but  they  cannot  assiu.-e  safety  during 
the  first  few  hundred  lioura  of  flight.  The  SST  development  wj.s  planned  such 
that  reliabllty  of  new  designs  was  to  be  tested  in  the  true  flight  environ- 
ment prior  to  depending  on  them  for  salety.  This  was  to  ba  achieved  by  pro- 
viding for  use  of  the  all  mechanical  backup  control  mode  during  early  flights. 
These  flights  were  to  be  restricted  to  light  gross  weights  with  a forward  eg 
where  augmentation  was  not  mandatory. 

j.  1.7.1  Quantitative  flight  safety — all  weatlter  landing  system  (VWI.S)  . The 
average  hazard  due  to  the  use  of  the  all  weatiier  landing  system  so. ill  be 
less  than  the  risk  allowed  in  the  contractor's  reliability  budget  for  the 
all  weather  landing  system.  To  meet  the  requirements  of  3.1.7,  the  contrac- 
tor shall  allocate  the  FUS  safety  budget  among  AI7LS  and  other  FCS.  The 
specific  risk  of  a hazard  due  to  use  of  the  landing  .system  under  an  environ- 
ment limit  or  operational  restiiction  shall  not  increase  the  allowed  risk  by 
a factor  of  more  than  thirty.  An  alert  height  shall  be  established  at  an 
altitude  such  that,  with  all  systems  operative  at  the  alert  height,  the 
probability  of  a hazard  occurring  during  the  landing  ir  extremely  remote, 
as  defined  in  6.6. 


3. 1.7. 1.1  Assessment  of  averase  risk  of  a hazard.  The  average  risk-  of  a 
hazard  due  to  use  of  the  all  weather  landing  system  .shall  be  established 
considering : 


a.  The  effect  of  each  failure  and  combination  of  failures  on 
system  performance  and  the  probability  of  their  occurrence. 

b.  The  effect  of  each  relevant  failure  and  combination  of  fail- 
ures in  systems  operating  concurrently  with  the  all  weather  landing  AFCS 
on  aircraft  performance  and  the  probability  of  their  occurrence. 

c.  The  probability  of  the  system  not  performing  within  the 
required  levels  as  specified  in  3.1.2.10  taken  in  conjunction  with  the 
probability  that  exceedance  of  those  performance  levels  will  result  in 
a hazard. 

3. 1.7. 1,2  Assessment  of  specific  risk.  For  each  environmental  limitation  or 
operational  restriction  which  limits  the  use  of  the  all  weather  landing  sys- 
tem, the  specific  risk  shall  be  established.  This  evaluation  shall  comprise 
the  average  risk  assessment,  adjusted  for  a 1.0  probability  of  occurrence  of 
environmental  limits  associated  with  the  operational  restriction. 

DISCUSSION 

An  assessment  tf  all  weather  landing  system  safety  should  be  compiled  to 
correlate  the  reliability  analyses.  The  assessment  should  comprise: 

An  analysis  of  the  average  risk  associated  with  the  system. 

Analyses  of  specific  risks  incurred  for  unusual  or  limiting  condi- 

ti>  ns. 

A description  of  assumptions  and  supporting  rationale  used  to 
develop  the  preceding  analyses. 

The  average  risks  are  defined  as  the  risks  incurred  by  using  the  system 
under  normal  operational  conditions  but  during  a limited  visibility  condition. 
The  potential  source  of  these  risks  are  comprehensive  since  many  systems  other 
than  the  AFCS  can  cause  conditions  contributive  to  a hazard  during  landing. 
Thus,  the  supportive  analysis  must  include  the  possible  contribution  to  hazard 
of  such  diverse  systems  as  the  AFCS,  the  manu.al  flight  control  system,  includ- 
ing the  stability  agumentation  systems,  etc. 

Malfunction  or  misfunction  of  the  airborne  systems  may  result  in  one  or 
a number  of  incidents  such  as  those  appearing  in  Figures  9D  and  lOD. 

The  probability  of  occurrence  of  each  of  these  incidents  must  be  deter- 
mined, considering  the  likely  pilot  actions  for  the  required  visibility 
condit ions . 


An  Incident  ma;*  occur  dm  to: 

The  effect  of  a single  failure  or  combination  of  failures. 

The  performance  of  a failure-free  system,  i.e.,  variability  of 
the  characteristic  system  parameter  about  its  average  value  or  operating 
condition  beyond  design  limits,  or  just  a rather  unlikely  occurrence. 

The  effect  of  a failure  combined  with  poor  performance  not 
related  to  the  failure. 

Speific  risk  is  defined  as  the  risk  incurred  whenever  the  aircraft  is 
operating  in  a limiting  condition,  either  environmental  or  procedural,  while 
landing  under  limited  visibility  conditions.  The  specific  risk  analysis 
provides  the  rationale  for  establishing  such  limits.  The  specific  risk 
analysis  comprises  the  same  data  which  formed  the  average  risk  analysis, 
except  adjusted  to  account  for  the  limiting  condition,  such  as  an  extreme 
crosswind,  or  maximum  approach  speed,  and  so  on.  An  analysis  is  required 
for  each  limiting  condition,  taken  one  at  a time.  In  addition,  the  analysis 
may  include  performance-affecting  parameters  for  which  a statistical  distri- 
bution is  not  feasible,  such  as  unusual  location  of  the  glide  slope  or 
localizer  transmitter,  extreme  approach  terrain  profiles,  or  worst  case 
combinations  of  runway  gradients. 

A complete  statement  of  assumptions  and  supporting  rationale  serves  two 
purposes  within  the  context  of  a svstem  safety  assessment.  The  statistical 
analysis  vri.ll  be  based  on  statistical  data  taken  using  limited  exposure  cimes 
of  components  and  equipment.  The  exposure  times  and  resulting  limited  confi- 
dence in  the  corresponding  data  may  substantiate  in-flight  or  ground  test 
procedures  or  regimen  necessary  to  maintain  the  basic  safety  status  of  the 
8ystem(s).  Occasionally  an  assumption  is  established  in  lieu  of  definitive 
data  or  nonexistent  data.  As  such  data  becomes  available,  a more  accurie 
assessment  may  be  made  of  Its  Impact  on  the  basis  for  system  safety. 

Reference  16  describes  a logical  method  of  evaluating  the  safety  of  a 
landing  system.  Figure  8D  is  a model  of  the  possible  outcomes  of  any  approach. 
It  is  required  that  the  probability  of  a hazard  due  to  use  of  the  all  weather 
landing  system  should  be  extremely  remote.  Note  that  the  analysis  must  recon- 
sider the  approach  outcome  probabilities  after  executing  a missed  approach. 

The  outcome  tree  of  Figure  8D  may  be  further  subdivided  into  detailed  longi- 
tudinal and  lateral  outcomes  as  shown  in  Figures  9D  and  lOD  which  show  some  of 
the  incidents  which  may  be  hazardous.  Having  built  up  these  performance  trees, 
the  probabilities  of  each  event  must  be  evaluated  to  determine  the  probability 
of  a successful  landing  as  shown  in  Figures  IID  and  120. 

Since  not  all  incidents  will  result  in  a hazard,  a relationship  of 
incidents/hazards  must  be  assumed.  British  Civil  Air  Regulations,  paper  367, 
Is.3ue  3,  January  1970,  proposed  values  considered  to  be  represent itlve  of  past 
experience  and  this  should  be  used  unless  it  can  be  shown  that  these  values 
are  not  valid  for  the  procurement  aircraft.  The  incident  and  ratios  assume 
that  the  landing  facility  meets  the  recommendations  of  ICAO  Annex  14  with 
regard  to  the  strip  surrounding  the  runway.  This  extends  200  feet  before  the 
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Figure  8D.  Simplified  version  of  approach  outcome  ’*trei 
(General  breakdown  of  possible  approach  consequences) 


Figure  9D.  Longitudinal  approach  outcome  ' 


8' 


).  lateral  approach  outcome  **tree 


CCESSFUL  SUCCESSFUL 


Figure  IID.  Longitudinal  approach  and  landing  performance  ' 


Figure  12D.  lateral  approach  and  landing  pertei 


thr««hoId  and  to  300  f««t  on  each  side  of  tlt«  runvsy  csnterllne  of  which 
250  fatt  Has  a prepared  surface,  the  remainder  being  clear  of  obstructions. 
Where  these  recommendat ions  are  not  met,  the  values  given  below  should  be 
redefined . 


INCIOEWTS 

a.  Overrun  runway  but  not  mure  than  2«K)  feet 

b.  Overrur.  runway  more  than  20i)  feet 

c.  Hard  landing  harder  than  design  ultin.ate 
vertical  velocity 

d.  SlK>rt  landing  but  not  SK)rc  than  200  teet 
short  of  threshold 


HAZMU):  INCIDENT 
1:100 
i!  1 
1:10 


1:30 


«.  Short  l.inding  more  than  200  feet  short  of 
threshold 


1 : 1 


f.  Runoff  aide  of  runway  but  not  more  than  230 
feet  from  centerline 


1:30 


g.  Runoff  aide  of  runway  more  than  230  feet  from  1:1 

centerline 


h.  Land  with  excessive  crab,  sufficient  to  1:10 

collapse 

i.  Drag  wlngclp  before  gear  touches  ground  1:1 

J.  Drag  wingtip  after  gear  touches  ground  0:1 

k.  Land  off  side  of  runway  but  not  more  than  200  1:30 

feet  from  centerline 


1.  Land  off  side  of  runway  more  than  200  feet 
from  centerline 


1;  1 


3.1.8  Survivability . FCS  Operational  State  IV  or  State  V shall  be  pro- 
vided as  r-:^qulred  by  the  procuring  activity. 

3. 1.8.1  All  engines  out  control.  For  those  aircraft  wliich  are  dependent 
upon  engine  generation  of  flight  control  system  power,  supplementary  means 
or  power  source  shall  be  provided  as  necessary  to  supplement  the  control 
power  available  from  the  engine (s)  where  engines  are  unproven,  airframe 
aerodynamics  not  established  In  flight,  or  windmilling  power  is  insufficient 
to  maintain  operational  State  IV  control  capability  anywhere  In  cne  aircraft 
operational  envelope.  Flight  ccctrol  system  design  (including  power  sources) 
shall  be  such  that  unintentional  loss  of  any  or  all  engine  thrust  shall  not 
result  in  less  than  FCS  Operational  State  IV  including  any  necessary  transi- 
tion to  emergency  source (s)  of  power.  Provlsicn  shall  be  made  for  inflight 
reversion  to  normal  power  wherein  the  transmission  shall  not  result  In  a 
worse  FCS  operational  state. 
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ti'reKoit>|i  survivability  rrquircntcnta  arv  apcclftad  In  rccoRnltlon  of 
the  i\>l  lowing  i actors  ^ 

That  aircraft  parforsmc*  rcqulraMnta  tr>r  ring*,  payload,  spaad, 
*>tc..  often  dictate  the  need  for  such  lightweight,  coa^iset  alrfraaaa  that  it 
<H  difficult  tc  provide  the  necessary  redundancy  wnd/or  spatial  separation 
of  subsystems  to  meet  the  specified  flight-safety  requircttenta. 

That  such  strlngsnt  perfors«nce  requlrcsMnts  slso  neke  It  difficult 
to  provide  the  required  Invulnersbll Ity  to  enemy  action. 

Tfuit  superaonlc  upee^is,  site,  or  other  factors  introduce  ecrodynnmic 
surface  hinge  moments  of  such  msgnltude  that  fully  po%fcrsd  systems,  without 
provision  for  revision  to  mecfutnicsl  control,  are  required. 

That  for  some  advanced  aircraft  the  performance  requirements  are  so 
stringent  tlvat  Mta*c-of'-the- art  advancementb  requiring  several  years  of 
refinement  aster  introduction  of  the  aircraft  into  service,  before  attainment 
of  a given  reHabllit'  requirement  can  be  at^sured,  will  be  required  (e.g., 
tiiatorical  experience  with  such  advanced  aircraft  as  the  F-lOO,  B-S8,  and 
F-ni). 

The  Air  Force  has  recognired  these  factors,  and  the  development  of  sur- 
vivability motor -pump  servoactuator  ("power-by-wlre")  units  on  the  A1)P  68C-J 
program  has  denonstrsted  that  practical  limited-authority  control  servos  can 
be  incorporated  to  achieve  ti.ese  survivability  requirements.  See  References 
64,  t)5,  and  6b.  Also,  see  3. 2. 6. 5. 4 herein  for  rcqulramcnts  for  inte- 
grated survivability  servoa.  tuators. 

It  sliould  also  be  recognized  tfu.t  incorporation  of  such  limits  can  have 
major  impact  upon  the  design  of  flight  control  actuation  installations. 
Therefore,  unless  otherwise  specified  by  the  procuring  activity,  such  units 
are  required  only  for  those  aircraft  tihere  It  is  agreed  that  the  design  or 
performance  requirements  are  such  that  the  flight-safety  requiremanta  and/or 
invulnerability  to  enemy  action  requirements  cannet  otherwlae  be  met. 

In  addition.  It  -»hould  be  recognized  that  th-  primary  intent  of  the 
survivability  provisions  Is  to  provide  sufficient  control  capability  for  the 
flight  crew  and  other  occupants  to  survive  situations  in  which  the  aircraft 
will  usually  be  lost  or  suffer  major  damago;  and,  where  appropriate,  to  also 
provide  a last-ditch  capability  to  safely  recover  the  aircraft’s  stores 
and/or  vital  equipment.  Even  with  highly  sdvaitced,  high  performanv^^e  aircraft, 
the  design  should  be  lilghly  resistant  to  loss  due  either  to  random  equipment 
failure  or  enemy  action. 

The  All-engines-out  control  requlrei«ent  is  based  upon  potential  economic 
consequence  in  loss  of  aircraft  oi  personnel  hazard  exposure  under  certain 
conditions.  All  aircraft  engine  power  ouiy  be  lost  from  a number  of  circum- 
stances involving  flight  envelope  expansion  of  prototype  or  developmental 
aircraft,  conenon  failure  modes  or  design  deflciencieti  of  engines,  engine 
control  systems,  and  inlet  ducting,  loss  of  fuel  or  fuel  pumping  capability. 
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and  lack  of  anitlna  wtndBllllng  powar  capability,  wh«ra  critical  for  flight 
control  putpoaaa.  It  la  not  tha  Intant  of  thla  raqulraiaant  to  arbitrarily 
raquira  the  addition  of  aMrgancy  powar  aourca(a)  for  uaa  in  flight  to 
provida  Oparational  Stata  IV  capability.  It  ia  intandad  that  thia  ■inianw 
control  capability  raquirataant  ba  catafully  addraaaad  and  coaplianca 
aaaurad  in  aircraft  davalopaantal  ana  oparational  phaaaa.  Tha  parti- 

cular aiaaiun  or  claaa  of  aircraft  auiy  dictata  ^ battar  oparational  atate 
for  tha  flight  controls  undar  al I-angina-out  Might. 

Thia  Burvivabil ity  raquiraaant  May  bo  aatitfiad  with  a atandhy  ataarganev 
FCS  which  providaa  tha  control  capability  to  ratum  to  baaa  and  auccaBBfully 
land  tha  aircraft. 

Rafaranca  67  daacribaa  a study  «fhoaa  objactlvaa  wara  to  datanaina  nini- 
•ua  raqulrataanta  for  backup  FCS  and  to  davalop  a doHign  procadura  for 
aynthaaicing  ■iniaun  backup  ayataaa. 

This  rtudy  found  that  pllot~baaad  raqulraawnta  arr  not  all  praciaaly 
daflnad  and  nuat  ba  poatulatad.  Hypothatiaad  pilot  rcquiranant a,  c^llad 
analytical  aaaauraa  of  "f lyabil ity”  and  "landabil  ity” , davalopad  through  tiiia 
study  ara  included  tharain. 

Rafaranca  68  predicts  that  a raquiramant  for  a ntandby  flight  control 
capability  will  also  exist  in  future  equipped  with  a(tivo  redundant  fly-hv-wi 
control  syateKS.  Quadruple  (t««o -fail-oparata)  identical  channels  with  com- 
paratiye  failure  atonitoring  octween  channels  at  varicus  critical  points 
throughout  the  control  path  have  been  proposed  to  petmit  conpletion  of  the 
mission  after  any  aingle  failutc  and  succcastul  recovery  of  the  aircraft  fol- 
lowing a ifacond  similar  random  failure. 

However,  no  suittav  how  complete  tlw  design  analyais,  thv**  circuit  protec- 
tion incorpoTAted , or  tlie  phyaical  protection  of  channels,  catastrophic,  high 
intensity  short  circuits  produced  by  battle  dasuiga  or  failed  alactrical 
components  can  propagate  tha  failure  throughout  all  idrntlcal  channels  it 
cosMon  points  exist.  When  idantical,  redundant  channels  are  employed,  Ident 1 
cal  failure  modes  also  may  exist.  If  severe  physical  or  environmt ntal  condi- 
tions (I.C.,  temperature,  vibration,  radiation,  eltock)  are  encouni;ered  which 
exceed  original  design  criteria,  failure  of  all  redundant  channels  can  result 
within  a relotlvely  short  time  pt^rlod.  Redundancy  is  designed  to  protect 
against  random  component  faiiurea  but  little  advantage  is  gained  when  all 
channels  are  simultaneously  overetrewsed . 

A questionable  major  aasuaotion  in  rel lability  computational  theory  is 
that  one  failure  docs  not  propegac'  additional  failures.  While  great  strides 
have  been  made  in  development  of  fall-passive  electronic  designs,  completelv 
fall-passive  systesw  do  not  exist.  Murphy's  Law  is  rarely  violated  In 
particular,  combat  damage  greatly  increases  the  prohabillty  of  multiple 
failures  and  high  intensity  shorts.  Also,  no  fail-passive  motion  seurors 
now  exist.  It  is  imposaibic  to  predict  end  protect  against  all  conditions 
and  failures  to  which  tha  aircraft  will  be  subjected.  Historical  cases  foi- 
thls  situation  are  plentiful  and  the  following  are  listed  as  .yplcal  examples 
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P'-A  and  F-105  Aircraf t-'*Nun»rouH  aircraft  liav*  baan  loat  to  ground- 
fira  dua  to  alaultanaoua  ruptura  of  radundant  hydraulic  llnaa  at  critical 
points  throufhout  tha  fu«ala|a  and  wing  whara  thay  ara  routad  In  cloaa 
prosialty  to  ona  ancthar.  Daalgn  phlloaophy  orlginall"  applied  to  thaaa 
vahlclaa  conaldarad  that  thaaa  aircraft  wculd  not  ba  anpluyad  In  a coabat 
anvlronaant  wharo  groundflra  could  ba  affactiva. 

X-15,  Nr.  1 — All  alactrlcal  and  hydraulic  powar  wara  loat  on  ona 
flight  at  tha  apogaa  of  ita  trajactory  whan  an  axparlaantal  alactronlca  unit 
ahortad  undar  cold  taaparatura  condltlona.  One  hydraulic  API'  waa  finally 
reatartad  and  tha  aircraft  waa  racovarad  with  no  alactrlc.tl  power  available. 
Circuit  protection  %faa  Inatallad  which  ahould  have  prevented  loaa  of  both 
redundant  alactrlcal  ayatana. 

F-lllA,  Nr.  15 — Engine  atall  resulted  in  subaequant  loss  of 
primary  syataai  hydraullca  and  waa  vary  quickly  followed  by  loaa  of  tha 
utility  hydraullca  «dilch  fora  tha  reserve  ayatam.  Difficulty  in  maintaining 
control  raaultad  In  ejection  of  both  pilots  and  loss  of  tha  aircraft. 

X-22— Ona  alrciaft  waa  aavaraly  damaged  when  both  dual  hydraulic 
tubing  runs  ruptured  almoat  alnultaneoualy  due  to  fatigue  developed  from  an 
unexpected  reaonant  vibration  condition. 

F-14— Tha  firat  T-14  waa  loat  dua  to  tha  cane  causa. 

B<*52’— A B>52  %«a  lost  at  WFAFB  In  1974  due  to  ainilar  fatigue 
related  dual  hydraulic  tubing  failures.  A first  failure  occurred  and  craw 
warning  waa  displayed,  indicating  loss  of  fluid  in  one  hydraulic  *)ysteu. 

The  mission  was  continued  and  two  hours  later  .i  similar  failure  occurred 
in  tha  second  hydraulic  syatan,  resulting  in  complete  loss  of  elevator 
control.  A night  landing  attempt  in  poor  viaib’ity  conditions  using 
atablliier  trim  was  unsuc<:.assful . 

Ideally  from  th  ' survivability  standpoint,  the  standby  flight  control 
system  would  be  mechanlied  with  (1)  no  parts  Identical  to  the  norxtal  Manual 
FCS  components,  (2)  complete  Independence  from  the  normal  FCS,  (3)  an  inde- 
pendent power  medium,  and  (4)  physical  dispersion  and  Isolation  from  all 
normal  manual  FCS  components  and  transmission  elements  to  minimize  the 
possibility  of  unpredlcted  failures  or  hits  from  knocking  out  all  means  of 
control.  Also,  a high  degree  of  versatility  for  pilot  selection  of  alter- 
nate control  surfaces  (i.e.,  split  surfaces,  flaps,  spoilers,  etc.)  is 
desirable  to  permit  relatively  stabilized  flight  with  severe  damage  to  the 
control  surfaces.  The  ke:  to  the  success  of  developing  a highly  simplified 
standby  FCS  Is  the  fact  that  performance  requirements  arc  considerably  less 
In  the  emergency  mode  than  are  the  performance  requirements  for  normal 
mission  operation. 

It  must  alro  bt  noted  that  principles  of  system  design  for  survivability 
aad  low  vulnerability  arc  often  In  direct  contradiction  to  principles  of 
good  maintenance.  Fsr  example,  good  melntenance  design  %K>uld  loc»ie  redun- 
dant elements  close  :ogether  for  ease  of  service  checkout,  and  replacement. 
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Um  of  nonidcnt leal  coapenanta  between  the  PCS  and  the  standby  PCS  to  avoid 
identical  failure  modes,  increases  logistics,  training  and  repair  problems. 

Recommended  design  requirements  for  standby  emergency  flight  control 
systems  established  by  Reference  68  include: 

The  standby  PCS  should  be  the  minimum,  simplest  form  of  system 
%dilch  will  permit  recovery  of  the  aircraft,  return  to  base,  and  landing 
following  loss  of  the  normal  PCS  due  to  battle  damage  or  component  failures. 
Adequate  control  surface  effectiveness  to  maintain  trimmed  flight  and  to 
permit  low  level  maneuvering  in  the  landing  aonc  is  assumed.  No  attempt 
to  complete  the  miasion  on  standby  PCS  should  be  expected.  A minimum  of 
two  (2)  hour  flight  on  standby  PCS  should  be  possible. 

Complete  independence  should  be  maintained  between  the  normal 
Dtanual  PCS  and  the  atandby  PCS  channels.  This  should  include  control  stick, 
controller,  sensors,  actuators,  and  power  supplies  (electrical,  hydraulic, 
or  pneumatic).  A control  power  medium  different  from  that  used  in  the 
normal  system  should  be  considered. 

Standby  control  syatam  design  should  be  as  simple  as  possible  to 
provide  handling  qualities  of  Level  3 or  better.  Closed-loop  control 
should  on)''  be  employed  if  this  requirement  cannot  be  satisfied  with  direct 
control  techniques.  Safety  aspects  wl»ich  V7tll  permit  return  of  the  aircraft 
and  crew  should  predominate  over  more  complex  designs  having  higher  per- 
formance. 


Engagement  of  the  standby  PCS  should  be  automatic  upon  loss  of  one 
or  more  PCS  hydraulic  pressures.  In  addition,  the  pilot  should  be  provided 
with  a switch  to  engage  or  override  the  automatic  device  if  complete  normal 
PCS  failure  should  result  due  to  any  other  cause  or  if  false  switching  should 
occur  when  hydraulic  pressure  has  rot  been  lost. 

Provisions  should  be  included  to  permit  Instantaneous,  positive 
control  transfer  from  the  normal  PCS  to  the  standby  PCS  or  vice  versa. 
Transfer  should  be  accomplished  without  inducing  aircraft  transients  exceed- 
ing structural  limits  or  -f2.0  g's  whichever  is  lower  due  to  displacement 
of  the  control  surfaces  from  the  trim  position.  To  achieve  minimum  duty 
cycle,  protect  against  random  failures,  and  provide  small  sized  equipment, 
the  standby  PCS  should  be  designed  to  oe  flown  in  the  nonenergized  state. 

When  not  in  use,  the  standby  PCS  should  not  Interfere  or  degrade  perform- 
ance of  the  normal  PCS.  Physical  Interface  within  the  cockpit  must  be 
minimized.  Ejection  envelopes  must  be  maintained. 

Standby  flight  control  systems  should  be  low-cost,  light  weight, 
highly  reliable,  and  easily  Installed  In  existing  combat  aircraft.  Elec- 
trical, hydraulic,  and  pneumatic  additions  and  modifications  should  be  held 
tJ  a minimum.  DC  electrical  power  should  be  the  primary  electrical  source, 
field  modification  of  existing  aircraft  is  extremely  desirable. 

All  emergency  standby  pumps  and  power  supplies  should  be  physically 
located  as  close  to  the  actuators  as  possible  to  reduce  the  vulnerability  of 
long  transmission  runs.  All  major  components  of  the  standby  PCS  should  be 
protected  by  armor  or  located  in  s naturally  protected  area. 
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High  temperature  transmission  elements  (tubing,  wires,  fittings, 
connectors,  etc.)  should  be  installed  throughout  the  system  to  Insure  that 
fires  in  any  area  will  not  result  in  loss  of  operation  of  the  standby  PCS. 

If  closed-loop  emergency  control  is  required  for  flight  safety, 
structural  filters  in  the  standby  PCS  control  loops  should  be  neglected 
unless  complete  structural  instability  would  result.  High-gain  control 
loops  which  would  excite  the  structural  modes  should  be  avoided. 

Hardover  failure  of  the  standby  PCS  should  be  monitored  (i.e.,  by 
means  of  a 'g'  cutoff)  to  return  the  aircraft  to  a safe  trim  attitude. 

The  design  shall  be  fail-passive  where  possible  so  that  failure  of  any  part 
will  not  result  in  erratic  hlsh- frequency  oscillations  or  hardover  commands. 
Means  should  be  provided  to  disengage  a seized  standby  actuator  which  would 
prevent  normal  control  by  the  PC.-3.  Slab-lock  should  be  an  integral  function 
of  the  standby  PCS,  serving  as  the  final  emergency  mode  of  operatijn. 

Checkout  of  the  standby  PCS  should  be  a normal  part  of  the  ground 
test  prior  to  each  takeoff.  In  addition,  cycling  of  the  standby  PCS  in 
flight  prior  to  entering  a battle  zone  is  suggested. 

3.1.9  Invulnerability . Degradation  in  flight  control  system  operation  due 
to  variations  in  natural  environments,  adverse  events  of  nature,  induced 
environments,  onboard  failure  of  other  systems,  maintenance  error,  flight 
crew  error  or  eneffiy  actions  shall  be  within  the  following  limits. 

3, 1.9,1  Invulnerability  to  natural  environments.  Flight  control  systems  shall 
he  designed  to  withstand  the  full  range  of  natural  environmental  extremes 
established  for  the  particular  vehicle  or  system  wlthouc  permanent  degradation 
of  performance  below  PCS  Operational  State  I,  or  temp\>rary  degradation  below 
PCS  Operational  State  II.  Reductions  below  State  I rhall  be  experienced  only 
at  adverse  environmental  extremes  not  normally  encountered  and  shall  be 
transient  in  nature  only;  and,  the  function  shall  be  ’■ecovered  scon  as  the 
aircraft  has  passed  through  the  adverse  environment.  System  components  and 
clearances  with  structure  and  other  components  shall  be  adequate  to  preclude 
binding  or  jamming,  instability,  or  out  of  specification  operatxon  of  any 
portion  of  the  system  due  to  possible  combinations  of  temperature  effects, 
ice  formations,  loads,  deflections,  including  structural  deflections,  and 
buildup  of  manufacturing  tolerances. 

DISCUSSION 

Normally,  the  aircraft  specification  or  contract  will  define  the  natural 
environments  or  global  operational  areas  in  which  the  aircraft  must  perform. 

The  AFSC  Design  Handbook  DH  1-5  DN  ICl,  Environmental  Requirements,  describes 
methods  for  establishing  environmental  criteria  for  specific  systems  and 
vehicles.  It  must  be  kept  in  mind  that,  unless  elaborate  compensation 
features  are  provided  in  the  design,  some  temporary  performance  degradation 
(such  as  reduced  response  and  increase  in  force  levels  at  low  subzero  tempera- 
ture conditions)  will  normally  occur  in  most  flight  control  systems  when  sub- 
jected to  adverse  conditions.  This  degradation  is  usually  tolerable  if 
temporary,  completely  recoverable,  and  PCS  operation  does  not  degrade  below 
State  II  capability.  If  a specific  vehicle  is  required  to  operate  primarily 
in  a certain  combination  of  adverse  environments,  such  that  no  degradation 
below  State  I capability  can  be  tolerated,  this  requirement  must  be  specified 
in  the  vehicle  specification  or  contract. 
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3. 1.9. 2 Invulnei '^blllty  to  to  lightning  strikes  and  static  atmospheric 
electricity.  Fli,ji5t  control  system  shall  maintain  State  II  capability  or 
better  when  subjected  to  electric  field  and  lightning  discharges  as  speci- 
fied in  MIL-B--5087  and  in  AFSC  Design  Handbook  DH  1-5,  except  that  a 
temporary,  recoverable,  more  extensive  loss  of  performance  to  State  III 
is  allowable  in  the  event  of  a direct  lightning  strike. 

DISCUSSION 

This  requirement  takes  on  added  significance  as  more  reliance  is  placed 
on  electrical  means  of  control  in  the  flight  control  systems  (such  as 
essential  use  of  fly-by-wire,  stability  augmentation,  load  alleviation, 
and/or  ride  smoothing  features),  and  the  possibility  of  lightning  strikes 
cannot  be  Ignored.  Recent  history  of  commercial  jet  airplane  operations 
Indicates  that  regularly  scheduled  aircraft  experience  an  average  of  at 
least  one  lightning  strike  per  year. 

The  problem  of  providing  adequate  protection  may  be  compounded  by  the 
use  of  new  composite  materials  and  advanced  structural  concepts  in  the 
airframe  structure  and  aerodynamic  surfaces  which  are  being  developed  to 
save  weight  and  improve  life.  The  use  of  titanium,  stainless  steel,  bonded 
structure,  and  boron/ graphite  structure  introduces  new  problems  in  the 
electrodynamic  design  areas.  Changes  in  structure  electrical  conductivity 
can  have  adverse  electrical  effects  Including  loss  of  effectiveness  of  the 
structure  as  a shield  against  magnetic  and  electrostatic  fields.  The 
structure  may  no  longer  be  available  to  provide  suitable  antenna  ground 
planes,  lightning  protection,  electrical  power  ground  return,  and  shielding 
from  induced  voltages  into  critical  avionics  and  flight  control  systems  and 
interior  aircraft  components.  Electrical  compatibility  may  require  addi- 
tional ground  return  wire,  shielding,  conductive  coatings,  and  special 
joining  techniques  novel  to  composite  and  advanced  structure.  New  materials 
and  structural  concepts  should  be  thoroughly  evaluated  to  determine  the  most 
effective  method  of  providing  electrical  compatibility  with  a minimum  weight 
penalty. 

Detecting  and  avoiding  lightning  is  a simple  concept.  However,  a con- 
siderable future  development  may  be  required  bei ^re  it  can  be  considered 
practical  for  use  in  a tactical  aircraft  due  to  the  space  and  -’eight  require- 
ment of  the  airborne  lightning  detection  equipment,  the  nuisance  of  false 
alarms,  and  tlie  compromise  ri  a planned  mission  imposed  by  avoiding  lightning. 

Neutralizing  the  aircraft  Is  another  appealing  concept.  Statistics  on 
lightning  strikes  on  various  aircraft  types  indicate  substantial  differences 
between  the  number  of  lightning  strikes  reported  per  flight  hour  for  various 
aircraft  types.  These  statistics  indicate  that  some  aircraft  configurations 
are  inherently  less  vulnerable  to  lightning  strikes  or  that  the  aircraft  con- 
figuration Is  less  prone  to  initiate  lightning  strikes.  Results  of  future 
studies  of  this  phenomenon  may  identify  aircraft  design  features  which  reduce 
vulnerability  to  lightning. 

A technique  considered  most  likely  to  yield  satisfactory  results  is  to 
harden  the  aircraft  to  adequately  resist  lightning  strikes  which  may  attach 
to  the  aircraft  in  flight.  Potential  ways  to  approach  aircraft  hardening 
include : 
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Protection  should  bo  provided  from  lightning-induced  transients 
on  electronic  flight  control  interconnect  wiring.  Large  currents  result- 
ing from  a lightning  strike  flowing  through  the  aircraft  skin  can  induce 
significant  voltages  on  adjacent  interconnect  wiring.  To  minimize  these 
transient  effects,  balanced  circuits  using  twisted  shielded  wires  should 
be  used  where  possible  and  the  wiring  should  be  physically  separated  from 
likely  lightning  current  paths.  Redundant  channels  should  be  physically 
separated  from  each  ocher. 

Certain  air  data  and  aircraft  parameters  are  required  as  inputs  for 
electrical  flight  control  systems.  This  Information  is  obtained  from  probes 
mounted  external  on  Che  aircraft.  These  probes  can  be  damaged  by  lightning 
strikes.  To  prevent  damage,  lightning  diverters  can  be  usee  to  protect  the 
orifices  and  lightning  arrestors  can  be  used  to  protect  the  electrical  cir- 
cuits. 


Integrity  of  the  electrical  power  system  is  required  for  electrical 
flight  control  system  operation.  Points  of  entry  into  the  electrical  system 
such  as  external  light  wiring  and  pitot  tube  heater  wiring  should  be  assessed 
for  vulnerability.  The  wiring  can  be  protected  by  lightning  arrestors  located 
near  the  point  of  lightning  current  entry  if  required.  Power  generation  and 
distribution  should  also  be  examined  for  potential  susceptibility  to  tran- 
sients. If  such  susceptibility  exists,  then  arrestors  should  be  installed. 

To  provide  confidence  that  a particular  lightning  protection  system 
will  be  adequate,  lightning  simulation  testing  should  be  performed  on  new 
aircraft  configurations.  Scale  model  tests  should  be  performed  to  define 
potentially  vulnerable  locations  on  the  aircraft  where  lightning  will  attach. 
Components  located  in  these  vulnerable  areas  (e.g.,  wing  tip  lights)  should 
be  tested  for  high  current  and  voltage.  Consult  MIL-E-6051  concerning  light- 
ning tests  and  static  electricity.  Reference  85,  "Final  Draft,  Aerospace 
Recommended  Practice,  Lightning  Effects  Tests  on  Aerospace  Vehicles  and 
Hardx/are"  prepared  by  SAE  Committee  AE4,  Special  Task  F,  1 May  1974,  provides 
a definitive  comprehensive  guide  to  lightning  simulation  and  verification 
testing  of  aerospace  vehicles.  This  document  has  wide  general  acceptance  and 
is  expected  to  be  formalized  in  1975. 

3. 1.9. 3 Invulnerability  to  induced  environments.  Flight  Control  systems  shall 
withstand  the  full  range  of  worst  case  induced  temperatures  and  temperature 
shock,  acceleration,  vibration,  noise  and  shock,  induced  pressures,  explosive 
and  corrosive  atmospheres,  electromagnetic  interference  (EMI),  and  nuclear 
radiation  Including  electromagnetic  pulse,  projected  in  missions  for  the 
particular  aircraft,  without  permanent  degradation  or  loss  of  capability  to 
maintain  PCS  Operational  State  II  capability.  These  induced  environments 
within  structural  and  crew  survival  limits  shall  not  result  in  temporary 
degradation  during  the  exposure  to  the  environment  below  FCS  Operational 
State  IV  capability.  The  FCS  shall  meet  the  requirements  of  MIL-A-8392, 
KIL-A-8893,  and  the  applicable  requirements  of  MIL-E-6051  and  MIL-STD-461. 

DISCUSSION 

Unlike  natural  environments.  Induced  environments  usually  cannot  be 
specified  in  the  contract  or  statement  of  work,  but  will  be  dependent  upon 
the  design  of  the  particular  vehicle,  its  engines,  and  its  subsystems.  AFSC 
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Design  Handbook  DH  1-5,  Design  Notes  IBl,  Natural  and  Induced  Environments, 
and  ICl  Environmental  Requirements,  give  considerable  background  informa- 
tion. Tn  addition  to  that,  there  are  environments  Induced  by  the  flight 
control  power  systems.,  operating  normally  and  under  partial  failure  condi- 
tions, which  must  also  be  c.oi:isldered . 

Induced  vibrations  emanate  from  aerodynamic  and  engine  acoustic  energy 
impinging  on  aircraft  structure,  and  from  mechaniccl  vibrations  of  the 
engine  and  other  equipment.  Severe  levels  can  Induce  malfunctions  and 
fatigue  failures  in  flight  control  components.  All  control  system  elements 
must  be  designed  to  operate  satisfactorily  without  loosening,  malfunction, 
or  failure  in  the  vibration  environment  induced  during  all  required  opera- 
ting conditions  for  the  aircraft. 

Some  adverse  environments  Induced  by  the  hydraulic  power  system  are: 
temperature  rise  due  to  inefficiencies  in  the  pumps  and  other  parts  of  the 
system,  pressure  impulses  produced  by  the  pump  (pump  ripple)  and  through 
waterhammer  effect  due  to  rapid  opening  and  closing  of  control  valves,  and 
temperature  shock.  The  latter  can  cause  sticking  servovalves  which  could 
lead  to  erratic,  or  even  complete  loss  of  surface  control.  The  most  likely 
cause  is  the  creation  of  differential  fluid  temperatures  between  the  two 
systems  in  a dual-tandem  servoactuator  as  a result  of  either  a malfunc- 
tioning pump  in  one  system  or  an  open  relief  valve  bypassing  fluid  below 
the  pump  cutoff  pressure.  Thermal  shock  tests  must  be  set  up  very  carefully 
to  determine  if  a system  is  Immune  to  these  conditions. 

3 . 1 . 9 . 4 Invulnerability  to  onboard  failures  of  other  systems  and  equipment. 
The  PCS  shall  meet  its  failure  state/reliability  budget,  as  allocated  within 
the  weapon  system,  for  self-generated  failure  (within  the  FCS)  and  for  those 
PCS  failures  induced  by  failures  of  other  interfacing  systems  within  the 
weapons  systems  (3.1.6,  3.1.7).  In  addition,  the  FCS  design  shall  comply 
with  the  following: 

a.  Essential  and  flight  phase  essential  flight  control  systems  shall 
retain  FCS  capability  at  Operational  State  III  (minimum  safe)  or  better 
after  sustaining  the  following  failures: 

(1)  Failure  of  the  critical  engine  in  a two-engine  aircraft. 

(2)  Failure  of  the  two  most  critical  engines  in  aircraft  having 
three  or  more  propulsive  engines. 

(3)  Failure  of  any  single  equipment  item  or  structural  member  which, 
in  itself,  does  not  cause  degradation  below  State  III.  This  Includes  any 
plausible  single  failure  of  any  onboard  electrical  or  electronic  equipment 

in  any  subsystem  of  the  aircraft. 

b.  Flight  control  systems,  including  the  associated  structure  and 
power  supplies  on  Class  III  aircraft,  shall  be  designed  so  that  the  proba- 
bility of  losing  the  capability  of  maintaining  FCS  operation  to  no  less  than 
State  IV  as  a result  of  an  engine  or  other  rotor  burst  is  extremely  remote 
(6.6). 
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c.  Flight  control  systems,  including  the  associated  structure  and 
power  supplies  on  MIL-F-8785  Class  I,  II  and  IV  aircraft,  shall  be  designed 
so  that  the  probability  of  degrading  PCS  operation  below  State  V as  a result 
of  an  engine  or  other  rotor  burst  la  extremely  remote  (6.6). 

DISCUSSION 

The  requirement  Is  Included  to  ensure  that  hazards  due  to  failure  of 
other  systems  and  equipment  are  recognized  and  that  adequate  measures  are 
taken  In  the  design  to  ensure  that  the  flight  control  system  is  protected 
from  such  failures.  Most  aircraft  can  survive  engine  failures.  Including 
rotor  burst,  landing  gear  tire  burst,  and  failure  of  other  systems  such  as 
radio-radar  transmitter-transmission  line  failures.  Hc>wever,  with  the 
Increased  use  of  full-powered  flight  control  systems,  additional  care  must 
be  taken  tc  ensure  that  the  airplane  won't  be  lost  due  to  failures  it  could 
otherwise  survive. 

Protection  from  the  failure  of  high-energy  system  components  such  as 
pneumatic  cylinders,  hydraulic  accumulators,  and  hlgh-force  spring  cartridges, 
must  be  given  special  attention. 

There  have  been  recent  Instances  of  crashes  caused  by  flight  control 
system  malfunctions  resulting  from  hazards  originating  outside  the  PCS.  A 
Caravelle  crash  resulting  from  a wheel  well  fire,  causing  a total  hydraulic 
failure,  and  DC-10  crashes,  caused  by  cabin  floor  collapse  following  an 
explosive  decompression,  are  examples. 

In  addition,  electrical  flight  controls  are  more  vulnerable  than  con- 
ventional flight  controls  to  certain  hazards;  special  emphasis  should  be 
placed  on  the  design  and  tests  of  EFCS  equipment.  Examples  are: 

Modest  temperature  increases  which  would  not  affect  a conventional 
flight  control  system  can  cause  electronic  components  to  overheat  and  malfunc- 
tion. Accordingly,  cooling  air  supply  failures  must  not  affect  more  than  one 
channel  of  an  AFCS  computation  or  sensor  capability. 

Local  fires  must  not  be  allowed  to  propagate  through  areas  of  more 
than  one  channel  of  AFCS  computation  or  sensor  capability.  Both  separation 
and  measures  to  prevent  flame  propagation  are  needed. 

3. 1.9. 5 Invulnerability  to  maintenance  error.  Flight  control  systems  shall 
be  designed  so  that  it  is  physically  impossible  to  Install  or  connect  any 
component  item  improperly  without  one  or  more  overt  modifications  of  the 
equipment  or  the  aircraft.  Provisions  for  adjusting  the  flight  control  system 
on  the  aircraft,  except  during  initial  buildup,  major  overhaul,  or  rigging 
during  major  maintenance  activities,  shall  be  minimized.  All  line  replace- 
able units  (LPJi's)  shall  be  designed  to  permit  making  Internal  adjustments 
only  on  the  bench.  The  system  shall  require  only  a minimum  of  lerlgglng 
following  repla..ement  of  LRU's.  In  addition,  all  control  linkages  and  other 
flight  control  mechanisms  shall  be  designed  to  resist  jamming  from  Inadver- 
tent entry  of  maintenance  tools  or  other  material. 
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DISCUSSION 


This  requirement  is  especially  important  with  the  increasing  complexity 
of  flight  control  systems  and  components  which  tend  to  increase  the  potential 
for  serious  maladjustment  through  maintenance  error.  In  general,  the  first 
cost  due  to  Increased  engineering  effort  and  tooling  will  be  somewhat  higher 
than  normal  to  meet  this  requirement,  but  Lh'  overall  costs  of  maintenance 
and  the  probability  of  failure  or  loss  of  performa’^ce  will  be  much  lower. 

The  concept  has  been  used  on  some  systems  on  commercial  jet  airplanes  whose 
overall  record  of  dispatch  reliability  in  f^ay-to-day  operations  is  a very 
worthwhile  goal. 

In  the  study  completed  in  1972  to  document  aircraft  flight  control  sys- 
tems field  safety  experience  with  the  F-11]A,  F~AD,  C-141,  and  B-52G/H  air- 
planes, Reference  46,  it  was  found  that  (of  the  causes  lor  FCS  failure) 
faulty  maintenance  actions,  while  not  aa  numerous  as  material  failures,  were 
equally  catastrophic  in  some  instances.  In  general,  maintenance  actions  that 
result  in  accidents  or  hazards  are  not  as  easily  corrected  through  design 
action.  The  man  who  neglects  to  Install  a cotter  pin  or  safety  wire  would 
probably  also  neglect  to  assure  the  self- retaining  bolt  was  in  fact  self- 
retaining  or  that  a self-locking  nut  was  not  reused. 

However,  additional  design  assurances  such  as  adequate  access,  caution 
notes,  identification  toarkings,  and  unsymmetrical  Installations  would  help  to 
"deHurphyize"  installations  and  assist  maintenance  personnel  to  do  the  job 
right  the  first  time.  Specific  conclusions/ reconnendations  related  to  maivi- 
tenance  \>ere: 

Require  irreversible  parts  for  critical  appllcatiot.s  where  reverse 
assembly  or  installation  results  in  change  in  function  or  in  possible 
Interference. 

Require  that  adjacent  electrical/hydraulic  connections  have  physical 
differences  so  that  interchanging  connections  are  Impossible. 

Require  adequate  protection  be  provided  for  critical  components 
subject  to  damage  during  routine  maintenance. 

Ensure  that  technical  orders  and  manuals  contain  adequate  warning 
and  caution  notes  when  dimersions  or  procedures  are  critical  or  where 
malpractice  can  result  in  damage  to  equipment  or  Injury  to  personnel. 

Note  that,  in  addition  to  the  foregoing,  requirements  for  mainten- 
ance provisions  are  specified  in  Paragraph  3.1.10. 

3. 1.9. 6 Invulnerability  to  pilot  and  flight  crew  inaction  and  error.  Flight 
control  systems  shall  be  designed  to  minimize  the  possibility  of  any  flight 
crew  member  controlling  or  adjusting  system  equipment  to  a condition  state 
which  could  degrade  FCS  operation. 

a.  Protection  against  improper  position  and  sequencing  of  controls — 
Wherever  practical,  cockpit  controls,  other  than  stick  or  wheel  and  rudder 


97 


pedals,  shall  be  equipped  with  positive  action  gates  to  prevent  Inadvertent 
positioning  which  can  compromise  safe  operation  of  the  aircraft.  Positive 
Interlocks  to  prevent  hasardous  operation  or  sequencing  of  switches  shall 
be  provided. 

b.  Protection  against  Inflight  engagement  of  control  surface  locks. 

c.  Pilot  reaction  to  failure — Flight  control  systems  shall  be  designed 
80  that  the  normal  pilot  reactlot\  to  cues  provided  by  probable  failure 
conditions  Is  Instinctively  correct. 

d.  Warning  requirements — 

(1)  Warning  information  shall  be  provided  to  alert  the  crew  to 
unsafe  system  operating  conditions.  Systems,  controls,  and  associated 
monitoring  and  warning  means  shall  be  designed  to  preclude  crev  errors  that 
create  additional  hazards. 

(2)  A clearly  distinguishable  warning  shall  be  provided  to  the 
pilot  under  all  expected  flight  conditions  for  any  failure  In  a redundant 

or  monitored  flight  control  system  which  could  result  In  an  unsafe  condition 
if  the  pilot  were  not  aware  of  the  failure.  '< 

DISCUSSION 

Like  prevention  of  maintenance  error,  the  system  designer  can  do  much 
to  minimize  pilot  and  flight  crew  error.  The  Reference  46  study  summarized 
that  flight  crew  actions  were  involvec*  in  only  a small  number  of  failure 
case  histories.  However,  the  following  significant  recommendations  were 
drawn : 


Require  positive  interlocks  to  prevent  hazardous  operation  or 
sequencing  of  switches. 

Require  that  positive  warning  cues  be  provided  when  the  pilot  Is 
required  to  maintain  his  head  "ouL-of-cockplt"  during  maximum  maneuvering 
situations.  Consider  use  of  head-uo  displays. 

Require  that  a loss-of-control  prevention  device  be  incorporated 
in  aircraft  that  are  not  highly  resistant  to  departure  from  controlled 
flight. 


Ensure  that  the  flight  test  program  adequately  identifies  near- 
stall/stall/post-stall characteristics. 

Require  positive  stick  centering  as  outlined  in  MIL-F-8785  after 
modification  as  well  as  during  Initial  design. 

Require  that  all  cockpit  controls  be  equipped  with  positive  action 
gates  to  prevent  inadvertent  positioning  which  can  compromise  the  safety  and 
operation  of  the  aircraft.  An  example  is  an  idle  cutoff  detent  on  throttles. 

Require  cockpit  instrument  Illumination  level  compatibility  be 
demonstrated  in  a simulator  or  by  other  means. 
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One  exanplc  where  Interlocks  may  be  needed  to  prevent  hazardous 
operation  Involveii  variable  geometry  controls.  Redundant  Interlocks  should 
be  used  to  prevent  Inadvertent  actuation  of  control  systems  that  would 
produce  structural  damage.  If  actuated.  For  Instance,  flap  actuation  with 
wings  swept  must  be  prevented. 

The  Intent  of  this  warning  requirement  Is  to  provide  crew  warning 
where  a hazard  cannot  be  otherwise  avoided.  Warning  lights  should  not  be 
used  as  a substitute  for  adequate  FCS  design. 

3. 1.9. 7 Invulnerability  to  enemy  action.  Essential  and  flight  phase  essen- 
tial flight  control  systems,  Including  associated  structure  and  power  sup- 
plies, on  all  aircraft  designed  for  combat  operations  shall  withstand  at 
least  one  direct  encounter  from  the  threat  defined  by  the  procuring  activity 
without  degradation  below  Operational  State  III. 

DISCUSSION 

F-105  losses  In  North  Vietnam  and  Laos  have  been  documented  and  type  of 
threat  responsible  for  losses  and  the  type  of  system  damage  responsible  for 
these  losses  has  been  recorded.  Due  to  unacceptably  high  losses  due  to 
flight  control  system  damage,  this  requirement  has  been  adopted  for  future 
procurement. 

This  requirement  establishes  the  minimum  protection  required  for  all 
aircraft  designed  for  combat  operation.^.  Adequate  redundancy,  alternate 
controls,  separation,  shrouding,  and/or  armour  protection  should  be  used  to 
prevent  degradation  below  the  specified  performance  level.  See  Reference  69 
for  discussion  of  gunfire  tests  on  airplane  flight  control  servoactuators. 
Reference  70  provides  design  guidance  for  protecting  hydraulic  systems  from 
ground  fire,  and  also  lists  other  pertinent  documentation.  AFSC  Design 
Handbook,  DH2-7,  also  provides  guidance  information . 

3.1.10  Maintenance  provisions.  FCS  design  and  Installation  shall  permit 
normally  available  maintenance  personnel  to  safely  and  easily  perform 
required  maintenance  under  all  anticipated  environmental  conditions.  Means 
shall  be  provided  to  facilitate  the  accomplishment  of  all  required  mainten- 
ance functions  Including:  operational  checkouts,  system  malfunction  detec- 

tion, fault  isolation  to  the  (line  replaceable  unit)  level,  LRU  removal 
and  replacement,  inspection,  overhaul,  servicing,  and  testing. 

3.1.10.1  Operational  checkout  provisions.  Flight  control  systems  shall  be 
designed  with  provisions  for  operation  on  the  ground,  without  operating  the 
main  engines,  to  verify  system  operation  and  freedom  from  failure  to  the 
maximum  extent  practical.  They  shall  be  designed  to  operate  with  the  power 
generation  subsystems  supplied  by  standard  Air  Force  ground  carts,  as  speci- 
fied by  the  procuring  activity  or  by  self-contained  power  supplies. 

3.1.10.2  Malfunction  detection  and  fault  Isolation  provisions.  Means  pro- 
viding a high  probability  for  detecting  failures  and  monitoring  critical 
performance  conditions  as  required  to  isolate  faults  to  the  IJIU  level  shall 
be  Incorporated  In  all  flight  control  electrical  and  electronic  systems 
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required  to  perform  esscntlel  end  flight  phesc  eeeentlel  functiona.  Theac 
means  may  Include  cockpit  instrumentation  and  built-in  teat  equipment.  For 
the  mechanical  and  fluid  power  portions  ol  the  flight  control  ayatem,  pro- 
visions for  the  use  of  portable  test  equipment  laay  also  be  incorporated  as 
required  to  vwet  the  maintenance  support  and  operational  concept  of  the 
particular  weapon  system. 

3.1.10.2.1  Use  of  cockpit  instrumentation.  Where  acceptable  procedures 
result  or  are  provided,  cockpit  instrumentation  may  be  used  for  malfunction 
detection  and  fault  isolation  %ihere  it  provides  readily  understandable 
condition  indication  either  alone  or  in  coordination  with  built-in  teat 
equipment,  or  with  portable  test  equipment  (for  nonelectrical  and  nonelec- 
tronic components). 

3.1.10.2.2  Provlaions  for  checkout  with  portable  test  equipment . Where  the 
use  of  built-in  test  equipment  would  cause  excessive  penalties  and  where  the 
use  of  portable  test  equipment  is  compatible  with  the  maintenance  support 
concept,  provisions  shall  be  made  to  permit  the  use  of  generally  available 
and  commonly  used  portable  test  equipment.  Components  which  require  pecu- 
liar, special,  or  new  items  of  test  equipment  shall  be  avoided. 

3.1.10.3  Accessibility  and  serviceability.  Coc.ponents  shall  be  designed. 
Installed,  located,  and  provided  with  access  so  that  inspection,  rigging, 
removal,  repair,  replacement,  and  lubrication  can  be  readily  accomplished. 
Suitable  provisions  for  rigging  pins,  or  the  equivalent,  shall  be  made  to 
facilitate  correct  rigging  of  the  control  system. 

3 1.10.4  Maintenance  personnel  safety  provisions.  Systems  and  components 
shall  be  designed  to  preclude  Injury  of  personnel  during  the  course  of  all 
maintenance  operations  including  testing.  Where  positive  protection  cannot 
be  provided,  precautionary  warnings  cr  information  shall  be  affixed  in  the 
aircraft  and  to  the  equipment  to  indicate  the  hazard,  and  appropriate  warnings 
shall  be  Included  in  the  application  maintenance  instructions.  Safety  pins, 
jacks,  locks,  or  other  devices  intended  to  prevent  actuation  shall  be  readily 
accessible  and  shall  be  highly  visible  from  the  ground  or  include  streamers 
which  are.  All  such  streamers  shall  be  of  a type  wliich  cannot  be  blown  out 
of  sight  such  as  up  into  a caviry  in  the  aircraft. 

DISCUSSION 

Successful  operation  of  an  aircraft  and  its  flight  control  system  is 
highly  dependent  upon  the  ability  of  the  service  personnel  to  effectively 
maintain  it  in  the  fully  operational  condition.  The  foregoing  requirements 
emphasized  that  the  features  which  allow  effective  maintenance  must  be 
designed  into  the  system  to  provide  service  personnel  the  means  for  safe, 
speedy  detection,  location,  and  correction  of  faults,  and  the  accessibility 
necessary  for  preventive  and  corrective  maintenance  and  for  part  removal 
and  replacement. 

Functional  Checkout  Provisions 


The  need  to  provide  direct,  easily  accomplished  capability  for  checking 
the  system's  operational  status  on  the  ground  without  operating  the  main 
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engines  is  eclf-cvldcnt.  However,  full  perfomeucc  need  not  be  demonstrated 
if  system  condition  and  freedom  of  failure  adequate  for  safe  completion  of 
all  operational  modes  can  be  satiafactorily  demonstrated.  Tliercfore,  it  vill 
usually  not  be  necessary  to  supply  hydraulic  flow  from  the  ground  cart,  APU, 
GPU,  etc.,  at  the  full  system  design  flow  rate.  Also,  it  is  recognized  that 
It  is  impractical  to  verify  the  condition  of  engine  driven  pumps,  generators, 
and  associated  components  and  circuitry  without  running  engines. 

Ma Ifunction  Detection  and  Fault  Isolation  Provisions 


The  specified  requirements  emphasize  that  the  means  to  detect  failures 
and  Isolate  faults  to  the  LRU  level  in  essential  flight  control  electrical 
and  electronic  systems  must  be  incorporated  into  the  basic  onboard  equipment. 
However,  these  functions  arc  not  necessarily  required  in  flight.  It  is  also 
recognized  th.’'t  such  a requirement  often  cannot  be  met  with  practicality  in 
the  mechanical  and  fluid  power  portions  of  the  system,  and  that  provisions 
for  checkout  with  portable  teat  equipment  should  t>e  made  with  recognition  of 
the  problem  in  keeping  the  teat  equipmepc  current  with  airplane  changes. 

Careful  attention  tc  detail  circuitry  is  required  early  in  the  design 
phase  in  order  to  satisfactorily  incorporate  the  necessary  built-in  test 
equipment. 

Accessibility  and  Serviceability 

In  addition  to  the  specified  requirements,  the  design  of  mechanical 
controls  should  be  such  that  removal  and  replacement  of  components,  including 
the  control  surfaces,  can  be  accomplished  without  disturbing  the  rigging 
Insofar  as  possible.  Special  lo  >ls  require*^,  for  Installation  and  ri?;gi.ig 
of  the  control  systems  should  be  kept  to  a minimum  and  be  in  accordance  with 
the  applicable  specif ication^'.  Care  should  also  be  taken  to  avoid  installa- 
tion of  items  which  may  require  replacement  in  areas  where  removal  and 
relnstallatlon  is  ex'remeiy  ulificuit,  such  as  torque  tubes  buried  in  wings. 

Maintenance  Personnel  Safety 

It  is  Incumbent  upon  the  design  org^^ Ization  to  ensure  that  all  com- 
ponents and  systems  are  designed  and  Installed  to  allow  maintenance  without 
significant  hazard  to  the  se'vice  personnel.  It  must  be  recognized  that 
some  hazards  cannot  be  avoided  or  eliminated  altogether,  and  that  precau- 
tionary warnings  must  be  attached  to  or  adjacent  to  the  actual  com^'cnents 
and  be  Included  in  the  maintenance  procedures  and  instructions. 

In  the  flight  control  system,  two  of  the  most  hazardous  areas  of  concern 
to  the  maintenance  personnel  are: 

The  Inadvertent  release  of  stored  mechanical,  hydraulic,  pneumatic, 
or  electrical  energy;  i.e.,  from  springs,  air-oil  accumulators,  air  bottles, 
charged  capacitors,  etc.,  which  can  be  hazardous  even  with  system  power 
sources  turned  off. 

Inadvertent  motion  or  excessive  rate  of  motion  of  control  surfaces 
or  control  and  power  actuators  both  within  the  flight  control  system  and  in 
other  systems  using  the  same  power  sources,  such  as  for  the  actuation  of 
wheel-well  or  weapon-bay  doors. 


101 


/Ml  fli'vlct's  which  contain  any  typ«  of  stor»*d  cnorgy  (auch  as  aechanlcal* 
eloctrlc/M,  hydraulic,  or  pneumatic),  ol-  wlilch  can  produce  energy  capable  of 
causing  injury  to  maintenance  personnel,  should  be  provided  with  positive 
means  of  disconnecting  the  source  of  energy,  or  allowing  controlled  release 
<if  the  energy,  or  preventing  inadvertent  energy  releas- . 

In  addition  to  using  safety  pins,  locks,  or  other  devices  to  prevent 
Inadvertent  ui.  ' uation  of  other  systems,  all  flight  control  system  checkout 
and  tosi  provi/lons  sliould  be  designed  with  personnel  safety  In  mind.  During 
actu.ll  perfor*'ance  of  such  functions,  close  coord ln.it Ion  between  personnel 
operating  coc'iplt  controls  and  others  observing  system  operation  must  be 
maintained.  Other  maintenance  functions  wlilch  could  possibly  be  In  conflict 
should  he  prohibited  at  the  same  time,  and  all  personnel  should  be  kept  clear 
of  control  surfaces  to  prevent  being  knocked  off  balance  or  otherwise  injured. 

3.1.11  Structural  Integrity. 

3.1.11.1  St rength . The  overall  tlight  control  systems  shall  b designed  to 
meet  the  applicable  load,  streng>:h,  and  deformation  requiremem ..  of  MIL-A- 
8860,  MIL-A-88hl,  MlL-A-88f.5,  MIL-S-H698,  and  MlL-STD-1  S30.  The  components 
of  the  systems  shall  he  designed  In  accordance  with  the  strength  requirements 
of  MIL-A-88f,0,  y.IL-t:-b021,  MIL-F-7190,  MlL-A-21180,  MlL-A-22771  , NIL-F-83142, 
MlL-HDRK-5,  and  MlL-HDBK-17. 

3.1.11.1.1  Damaee  tolerance.  Those  structural  elements  of  the  flight  con- 
trol system  that  are  essential  to  safety  of  flight  (to  control  essential  and 
flight  phase  essential,  functions)  shall  meet  the  dtsmage  tolerance  require- 
ments of  M1L-A-8344A. 

3.1.11.1.2  Load  capability  of  dual-load-path  elements.  The  load  path  remain- 
ing after  a single  failure  in  dual-load-psth  elements  shall  meet  the  following 
requireftionts : 


a.  Where  the  failure  Is  not  evident  by  visual  Inspection  or  by 
obvious  changes  in  control  characteristics,  the  remaining  path  shall  be 
capable  of  sustaining  a fatigue  spec^rum  loading  based  on  one  overhaul 
period.  The  time  Interval  corresponding  to  an  overhaul  period  shall  be 
established  by  the  contractor.  The  remaining  path  shall  also  withstand,  as 
ultimate  load,  loading  equal  to  1.5  times  the  limit  loads  specified  In  MIL-A- 
8865,  or  1.5  times  the  limit  loads  specified  in  MIL-A-8865,  or  1.5  times 
the  load  from  an  alternate  source  such  as  a powered  actuation  system  or 
loads  resulting  from  aerodynamic  or  other  forces,  if  such  load  is  greater. 

b.  IThere  the  single  failure  Is  obvious,  the  remaining  load  path 
shall  be  capable  of  withstanding,  as  ultimate  load,  loading  equal  to  1.15 
times  limit  loads  specified  in  MlL-A-8865,  or  1.15  times  the  load  from  an 
alternate  source,  such  as  a powered  actuation  system  or  loads  resulting 
from  aerodynamic  or  other  forces,  if  such  load  is  greater. 

DISCUSSION 

These  are  basic  requirements  for  aircraft  design.  Additional  Information 
and  guidance  can  be  found  in  AFSC  Design  Handbook  DH2-1,  Design  Note  DN  2AI: 
Strength  and  Rigidity.  In  addition,  it  is  incumbent  upon  the  design 
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organlration  to  ex*‘r(-iiie  great  care  in  application,  drsign.  and  in  due 
regard  for  plausible  mlsfeaaancc  In  uae  to  aasiure  that  no  pnitH  o*  tlio 
■yatem  or  components  nciy  be  subjected  to  opetation,  eider  intei  m i t ( ent  I \ 
or  continuously,  at  loads  greater  than  for  which  the  part  has  laeit  dtsicno.'. 

The  essence  of  these  recfui  rements  is  that  the  design  o!  sli  uclaral  eU  ntiUs 
of  flight  control  systems  shall  he  such  that,  in  the  event  oi  ialluie  ot  a 
single  principal  clement,  the  rcm>ilning  structure  shall  be  capable  ot  sus- 
taining operational  loading  without  endangering  flight  aifitv.  ^ail-^  ii» 
deulgn  can  be  achieved  in  a number  of  ways,  including  the  following,  tv 
provide  adequate  residual  strength  for  repeated  loads  follow.ng  initial 
failures: 


By  multiple  load  path  structure. 

By  use  of  multiple  structural  memb<  rs  to  prevent  clack  pi  op.ig.it  iv'ii 
beyond  given  boundaries. 

By  apportioning  structure  to  ensure  th.it  undetectable  ctack.s  do 
not  Oecome  unstable  between  Insj-'ctlon  interv.als. 

The  use  of  dual-load  path  conf igurat  1-ons  in  the  deslcii  oi  structiu.tl 
and  mechanical  elements  In  ussentlal  subsystems  has  been  standard  practice 
for  commercial  jet  airlines  for  many  years.  The  s.ifety  f.iv  lor  of  1 . ‘'i  speci- 
fied in  3. 1.11. 1.2. a for  load  paths  in  which  failures  are  not  ea.silv  detec- 
ted, Is  the  same  as  required  for  single  load  path  stiuclute.  The  factor  of 
1.15  specified  In  3. 1,11.1. 2. b for  load  patlis  in  which  failures  are  i usilv 
detected,  is  to  provide  a reasonable  margin  for  dynamic  effeci.s  wltlch  m.iv  bo 
caused  by  a failure  in  tite  redtmdanc  load  path.  However,  it  i.s  assumed  that 
the  failed  part  will  he  replaced  before  accumulated  fatigue  danuige  beionns 
a significant  facic>i  . 

3.1.11. 2 Stiffness . Tlte  stiffness  of  flight  control  sy.stems  .sh.tll  be  suf- 
ficient to  provide  satisfactory  operation  and  to  enable*  tlte  alrct.ift  tc'  mec-t 
Che  stability,  control,  and  flutter  requirements  as  defined  in  the  appli- 
cable portions  of  MII.-K-8785,  MIL-A-8870,  Mil -F-83300  and  Mll-A-H8b5,  Normal 
structural  deflections  shall  not  cause  undesirable  control  system  inputs  or 
outputs. 

DISCUSSION 

It  is  required,  as  specified  In  MlL-A-8870,  that  aircraft  const rtict ion , 
materials,  and  design  shtll  be  such  that  there  will  be  no  flutter,  bucc, 
divergence,  or  other  dynamic  aeroelastlc,  .aerotheimcalust  ic , or  .u-iososvo- 
elastic  Instabilities  of  the  airplane  or  its  components  at  all  speeds  up  t.' 
1.15  for  all  design  ranges  of  altitudes,  thenmil  conditions,  and  maneuvers 
where  losses  in  rigidity  (stiffness)  may  occur,  and  at  all  weights,  external 
store  configurations,  and  other  loading  conditions,  .^s^ urance  of  compliance 
is  required  by  analytical  or  experimental  data  (including  flight  tost  data 
up  to  limit  speeds),  or  both,  that  an  increase  of  1 'i  percent  in  equivalent 
airspeed  at  all  points  on  thv^  limit  speed  envelope  of  the  airplane,  both  .it 
constant  Macli  number,  and  separately,  at  constant  altitude,  will  not  result 
in  flutter,  burr,  divergence,  or  other  dynamic  aeroelastlc,  aerothermoelast  ic , 
or  aeroservoelast ic  instabilities. 
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Detail  dcRlKn  r«qulr<»«n  .•  are  apaciflcd  In  MIL-A-8870  and  include 
the  followlns  which  are  quoewd  whole  or  in  part  with  minor  modlf Icatlona 
aa  deemed  neceasary  to  avoid  nlaunderatandlng: 

Auitaentatlon  ayatema.  For  alrplanaa  with  aup^ntatlon  ayateaa, 
the  apcnltled  flutter  aarglna  and  damping  requlrcmcnta  aunt  be  met  both 
with  the  ayatem  operative  and  with  It  Inoperative.  If  auftmentatlon  la 
eaaentlAl  to  aafety  of  flight,  augmentatlon-of f flight  teata  cannot  be 
performed  In  the  portion  of  the  flight  envelope  where  Ita  function  la 
eaaent lal . 


Fall-aafe  atablllty.  Aircraft  auat  be  free  from  flutter,  diver- 
gence, or  other  aeroclaatlc  Inatabllltles  at  all  apeeda  up  to  Vj^  following 
any  of  a apeclflud  Hat  of  lallurea,  malfunctlona.  and  advarae  condltlona 
pluB  any  other  probable  alngle  failure,  malfurctlon,  or  adverae  condition 
affectltib  'lutter  >r  divergence.  The  apeclfied  Hat  Includea  "failure, 
malfunction,  or  dlaconnectlon  of  any  alngle  element  of  the  main  flight 
control  ayatetn,  augmentation  ayatema,  automatic  flight  control  ayatema, 
tab  control  ayatem,  or  In  any  flutter  damper  connected  to  a control  surface 
or  tab."  "Detail  dealgn  ahall  be  auch  aa  to  provide  multiple  load  pAfhi< 
to  ellmlnat,:  rltlcal  alngle  fallurea,  or  aa  a minimum,  the  dealgn  should 
provide  a safe  life  of  critical  elementa.  With  such  a failure,  the  damping 
coefficient,  g,  rhall  be  at  least  I percent  (0.01)  for  all  critical  flutter 
modep  at  all  altitudes  and  speeds  up  to  V^." 

"Variable  geometry  airplanes.  Airplanes  having  variable  or 
movable  geometry  auch  as  tilt  wings,  variable  sweep,  variable  dihedral, 
rotary  airfoils,  and  pivoting  stores  •'•  ill  be  designed  to  preclude  flutter. 
Free  play  In  pivots  and  Joints  and  tht.  aerodynamic  Interaction  between 
lifting  surfacbS  in  close  proximity  shall  be  Included  in  flutter-safety 
evaluations. " 

"Control  au>  ice  and  tabs.  Fach  control  surface  or  tab  shall  be 
either  mass  balanced  or  ...  restrained  ...  to  preclude  flutter  In  all 
critical  modes,  under  all  flight  operations,  for  both  normal  and  emergency 
operating  conditions  of  the  actuating  system.  The  adequacy  of  mass  balance 
or  stiffness  shall  be  established  by  flutter  analyses  or  model  testr." 

In  MIL-A-8870,  It  Is  stated  that  the  surface  or  tab  be  nuss  bala.iced 
or  "mnde  irreversible  by  sufficiently  high  stiffness  and  compliance  with  free- 
plav  requirements  to  preclude  flutter  It  should  be  noted,  however, 

that  the  stiffness  requirements  can  be  mec  by  using  force  servos  or  control 
surf  ce  locks  (which  engage  upon  failure  of  the  actuation  system  to  function) 
as  well  as  by  using  so-called  Irreversible  (position)  servos. 

In  addition,  MIL-A-8870  also  states  that,  "In  determining  the 
adequacy  of  the  stiffness,  the  rigidity  (stiffness)  of  all  actuating  elements, 
the  rigidity  (stiffness)  of  the  control  surface  or  tab  shall  be  included.  In 
addition,  rotatlon.^1  freeplay  of  the  tabs  and  control  surfaces  shall  be  less 
than  or  equal  to  that  specified  In  3. 2. 7. 3.1  (Freeplay  of  Irreversible  Con- 
trol Surfaces)  and  3.2. 7.3.2  (Froeplay  of  Irreversible  Tabs)  throughout  the 
service  life  of  the  airplane." 
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^iontrol  surface  balance  is  also  Importai't  for  minimizing  control 
forces  and  Baintaining  stability.  The  three  important  balance  consldera- 
tions:  aerodynamic  I static,  and  dynamic  balance,  are  discussed  in  some 

detail  in  AFSC  Design  Handbook  DH  2-1,  Des:<gn  .Note  3B2;  Control  Surfaces. 

"Hydraulic  dampers.  In  the  event  that  mass  balance  or  irreversi- 
bility is  impracticable,  hydraulic  dampers  may  be  used  lor  the  prevention  of 
flutter.  Flutter  analyses  or  flutter  modal  tests  shall  be  performed  to 
assure  that  the  obtainable  damping  is  sufficient  to  prevent  flutter.  The 
rigidities  (stiffness)  of  the  damper  elements  and  the  supporting  structure 
to  which  the  elements  are  attached  shall  be  sufficiently  high  to  preclude 
loss  of  damper  effectiveness  by  structural  deformation  (deflection)  at  the 
flutter  frequencies.  The  freeplay  of  the  damper  shall  not  exceed  that 
specified  in  3. 2. 7. 3."  (In  MIL-A-8870). 

"Single-degree-of-freedom  flutter  of  control  surfaces.  Flutter, 
such  as  control  surface  buzz,  shall  be  prevented  by  providing  control  sur- 
face torsional  ard  rotational  rigidity  (stiffness),  by  use  of  hydraulic 
dampers,  by  use  of  aerodynamic  configurations  which  are  not  susceptible 
to  this  phenomenon,  or  by  a combination  of  these  means.  In  airplanes  whose 
Vl  equals  0.8  Mach  number  or  greater,  space,  rigidity  (stiffness),  and 
strength  shall  be  provided  for  incorporating  hydraulic  dampers  in  antici- 
pation of  vheir  use. 

"other  controls  and  aurfact^s.  When  not  displaced  from  the 
retracted  position  in  flight,  flaps  extending  outboard  of  the  50  percent 
span  station  of  the  main  surface  shall,  if  practicable,  be  rigidly  locked 
in  the  retracted  position.  Airplane  components  which  may  be  exposed  to  the 
alrstream  and  which  can  be  important  with  respect  to  flutter  (Including,  but 
not  limited  to,  trailing  edge  flaps  whicn  are  impracticable  to  lock;  dive 
brakes;  spoilers;  scoops;  leading  edge  flaps;  and  fixed,  retractable,  or 
Jettisonable  ventral  fins)  shall  be  made  free  from  flutter  by  suitable  mass 
balance,  hydraulic  dampers,  structural  rigidity  (stiffness),  or  irreversible 
control  systems.  The  irreversibility  criteria  for  control  surfaces  speci- 
fied in  3. 2. 7. 3 shall  be  applicable.  In  cases  where  mass-bal:.nced  reversible 
spoilers  are  employed,  coincidence  between  the  spoiler  rotational  natural 
frequency  and  low  natural  frequencies  of  the  main  supporting  structure  shall 
be  avoided  in  order  to  prevent  objectionable,  lowly  damped,  gust-excited 
oscillations. " 

3.1.11.3  Durability.  Flight  control  systems  shall  be  designed  to  meet  the 
durability  requirements  of  MIL-A-8866  and  equal  to  that  of  the  airframe 
primary  structure  considering  the  total  number  of  ground  and  flight  load 
cycles  expected  during  the  specified  design  service  life  and  design  usage  of 
the  aircraft  from  all  commands;  e.g.,  from  the  MFCS,  AFCS,  servo  feedback 
and  from  load  inputs.  The  requirements  of  MIL-A-8892  regarding  vibrations 
and  MIL-A-8893  regarding  sonic  fatigue  also  apply  to  the  FCS. 

DISCUSSION 

These  are  basic  requirements  for  aircraft  design,  and  it  is  especially 
important  that  all  essential  and  flight  phase  essential  components  comply. 
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As  stated  in  MIL-A-8866,  ''The  procuring  activity  shall  specify  the 
design  service  life  and  design  usage.  Where  .■structural  capabilities  are 
provided  by  the  contractor  beyond  that  specified  by  the  procuring  activity, 
these  additional  capabilities  she .1  be  included  in  the  design  usage,  and 
the  design  service  life  shall  be  maintained  and  so  stipulated  in  the  con- 
tract specification.  The  design  usage  shall  be  based  on  the  mission 
requirements  of  the  weapon  system  and  shall  stipulate  the  average  usage 
per  fleet  airplane  in  terms  of: 

Total  Flight  hours. 

Total  number  of  flights. 

Total  number  and  type  of  landings. 

Total  service  years. 

Mission  profiles  for  each  type  mission  including  training 
flights  to  be  flovm.  These  profiles  shall  be  divided  into  the  mission  seg- 
ments according  to  operational  segments  (l.e. , climbout,  cruise,  inflight 
refueling,  low-altitude  penetration,  air-to-air  combat,  air-to-ground 
combat,  etc.).  The  mission  profiles  shall  also  stipulate  the  approximate 
duration,  altitude,  airspeed,  and  payload  configuration  requirements  for 
each  mission  segment. 

Number  of  flights  of  each  mission. 

Proportion  of  I.’’  altitude  usage  (other  than  for  takeoff  and  land- 
ing operations)  between  .:_‘.iest  obstacle  clearance,  terrain  following  and 
contour  flying,  and  their  respective  terrain  clearance  requirements. 

Definition  of  the  terrain  roughness  models  and  the  number  of  ter- 
rain following  and  contour  flying  flights  for  each  mode]  or  definition  of 
the  low  altitude  routes  and  the  number  of  flights  for  each  route. 

Terrain  following  maneuver  load  factor  authority  (automatic  ter- 
rain following  mode)  requirements". 

From  this  information,  the  contractor  can  define  the  number  of  flight 
load  cycles  to  be  expected  during  the  lifetime  of  the  aircraft;  and,  with  a 
design  fatigue-scatter  factor,  as  defined  in  MIL-A-8866,  the  number  of 
fatigue  flight  loading  cycles  required  for  design  can  be  determined.  In 
addition,  the  accumulation  of  load  cycles  during  ground  checkouts  prlc  to 
flight  and  during  troubleshooting  maintenance  operations  must  be  accounted 
for.  Components  and  other  elements  subjected  to  loads  from  hydraulic 
actuators  bottoming  under  full  system  pressure  can  accumulate  significant 
fatigue  damage  during  such  operations.  Note  thct  fatigue  life  requirements 
may  be  more  stringent  than  wear  life  requirements  inasmuch  as  replacemenv, 
or  rework  of  parts  subject  to  wear  is  allowed.  (See  3.1.12) 

3.1.12  Wear  life.  Mechanical  elements  of  the  FCS  shall  be  designed  to  have 
wear  lif®  equal  to  the  wear  life  specified  for  the  overall  aircraft.  Parts 
subject  to  wear,  such  as  hydraulic  seals,  bear.ings,  control  cables,  sensors 
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and  hydraulic  actuator  barrels,  n-ay  be  replaced  theii  wearing  surfacet 
renewed  after  they  exceed  their  usetul  life.  However,  ail  replacements 
shall  be.  within  the  FCS  wear  out-replacement  budget  established  for  the 
overall  weapon  system.  Electronic  and  other  nonmectian i cal  LRU's  shall 
remain  economically  repairable  and  shall  meet  reliability  requirements 
throughout  the  specified  airframe  llfetiiue. 

DISCUSSION 

This  requirement  parallels  that  of  3.1.11.3  for  tatigue  life  in  that 
the  wear  life  of  the  flight  control  system  and  Its  components  must  also 
meet  the  requirements  specified  for  the  primary  aircraft  structure.  Predic- 
tions of  the  number  of  operating  cycles  and  their  Load  and  stroke  distribu- 
tion should  be  based  in  large  part  on  preflight,  taxi,  and  flight  test 
experience  with  similar  aircraft.  It  must  be  recognized  that  the  elements 
of  the  system  which  are  commanded  by  the  stick,  or  wheel  and  rudder  pedals 
will  usually  receive  the  bulk  of  the  long-stroke  cycles,  the  elements  com- 
manded by  the  AFCS  and  stability  augmentation  systems  will  usually  rect^lve 
the  bulk  of  the  short-stroke  cycles,  and  that  many  elements  will  receive 
all  the  commands.  In  order  to  develop  adequate  design.,  and  conduct  meaning- 
ful tests,  life  cycle  preaictions  for  each  portion  of  tlie.  system  must  be 
made  and  a budget  established  for  wear  life  of  all  FCS  parts. 

Electronic  and  other  nonmechanicai  components  wear  life  (useful  life) 
should  also  be  defined  in  cost  effectiveness  terms  for  a particular  weapon 
system.  For  example,  a criterion  might  be:  FCS  components  shall  not  require 

parts  replacement  maintenance  in  excess  percent  of  the  original  cost 

basis  throughout  the  airframe  lifetime. 

3 . 2 Subsystem  and  component  des Ign  requirements . 

3.2.1  Pilot  controls  and  displays.  Micrevet  an  FC.S  conltol,  dl.splay  or 
annunciator  is  interfaced  with  redundant  flight  confrol  channels,  mechanical 
and  electrical  separation  and  isolation  shall  be  provided  to  make  the  proba- 
bility of  common  mode  failures  at  least  extremely  remote.  FCS  controls  and 
displays  shall  be  designed  in  accordance  with  Mil, -STD- 1472 . 

3. 2. 1.1  Pilot  controls  for  CTOL  aircraii.  I'ii  t 's  ci'cLpit  toi.Liol.s  tor  con- 
ventional takeoff  and  landing  (CTOL)  aircraft  sliaJ]  be  designed  and  located 
in  accordance  with  AFSC  Design  Handbook  Dll  2-2,  DN  2A1,  Aircrew  Control.s; 

DN  2A5,  Flight  Controls;  and  the  following  subparagraph.s . Strict  adherence 
to  the  prescribed  location  and  maximum  range  of  motion  oi  the.se  control.s  is 
required. 


3. 2.1. 1.1  Additional  requirements  for  control  sticks.  II  a control  stick  is 
used  and  is  removable,  it  shall  be  positively  retained  in  place  when 
installed.  It  shall  be  possible  to  install  the  stick  only  In  tlie  correct 
manner,  and  suitable  means  shall  be  provided  to  prevent  rotation  of  the  .stick. 

3. 2. 1.1. 2 Additional  requirement  for  rudder  pedals  Rudder  pedals  shall  be 
interconnected  to  insure  positive  movement  of  each  edal  In  both  o i rec t icus . 


3. 2. 1. 1.3  Alternate  or  unconventional  controls.  If  pilot’s  controls  other 
than  the  conventional  center  located  sticks,  W-type  wheels,  rudder  pedals, 
trim  controls  and  indicators,  wing  incidence  control,  wing  sweep  control, 
landing  flap  control  and  Indicator,  speedbrake  control,  and  automatic 
flight  control  panels  specified  in  AFSC  Design  Handbook  DH  2-2,  DN  2AS, 

are  utilized,  demonstration  of  their  adequacy  and  suitability  is  required 
prior  to  installation  in  an  aircraft. 

3. 2. 1.1. 4 Variable  geometry  cockpit  controls.  Wing  incidence  controls  and 
wing  sweep  controls  shall  be  designed  and  located  in  accordance  with  AFSC 
Design  Handbook  DH  2-2,  DN  2A5;  Flight  Controls.  Other  controls  shall  be 
such  that  actuation  in  a forward,  upward,  or  clockwise  direction  results  in 
Increased  magnitude  of  the  controlled  variable  except  where  such  motion  is 
in  unavoidable  conflict  with  an  obvious  and  direct  relationship  between  the 
control  motion  and  resulting  change  of  the  controlled  variable. 

3. 2. 1.1.5  Trim  switches.  Electrical  trim  system  switches  of  the  five- 
position,  center-oft,  toggle  type  shall  be  in  accordance  with  MIL-S-9419. 
Control  stick  grips  in  accordance  with  MIL-G-25561  shall  already  have  the 
trim  switches,  conforming  to  MIL-"-9419,  installed.  Three-position  trim 
switches  shall  be  approved  switches  similar  or  equivalent  to  the  MIL-S-9419 
switches. 


3. 2. 1.1. 6 Two-Speed  trim  actuator.  Two-speed  trim  actuator  systems  shall 
be  designed  to  preclude  runaway  or  inadvertent  operation  in  the  high-speed 
trim  mode. 

3. 2. 1.1. 7 FCS  control  panel.  The  FCS  control  panel  shall  provide  the  pilots 
with  the  integrated  means  to  select  the  MFCS  and  AFCS  functions. 

3. 2. 1.1. 8 Normal  disengagement  means.  Means  for  disengagement  of  all  modes 
of  the  AFCS  shall  be  provided  which  are  compatible  with  the  requirements  of 
3. 1.9. 6. 


3. 2. 1.1. 9  Preflight  test  controls.  Additional  controls  shall  be  provided 
in  the  cockpit  for  initiating  and  controlling  the  progress  of  preflight 
tests,  where  necessary. 

DISCUSSION 

A high  degree  of  commonality  between  cockpits  of  aircraft  of  the  same 
type  is  required  in  order  to  minimize  the  possibility  of  human  error  as 
pilots  transition  from  one  aircraft  model  to  another.  The  specified  sections 
of  AFSC  Design  Handbook  DH  2-2  include  design  and  location  requirements  for 
cockpit  controls  for  conventional  aircraft  primarily  by  reference  to  MIL- 
STD-203  plus  several  updating  revisions.  A number  of  new  control  concepts 
such  as  hand  and  wrist  operated  side-arm  controllers,  and  the  RAMS-Horn  and 
Brolley-Handle  controls  to  replace  the  conventional  W-type  wheel  on  large 
aircraft,  will  provide  increased  visibility  of  the  flight  deck  control  panels 
for  use  of  moving  map  displays  and  other  advanced  pilot  aids.  Demonstration 
of  their  adequccy  rouy  he  accomplished  by  installation  on  a flight  control 
simulator  and/or  in  the  second  cockpit  of  a trainer  or  research  aircraft  as 
agreed  by  the  procuring  activity. 
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In  demonstrating  adequacy,  the  procedures  described  and  data  In 
Reference  71  may  be  helpful.  Reference  71  documents  an  inflight  Investiga- 
tion of  the  characteristics  of  three  unconventional  cockpit  controllers  In 
a variable  stability  airplane.  Controllers  evaluated  Included  a circumfer- 
ential wheel  segment  and  column,  a circumferential  wheel  segment  with  a 
hand-size  controller  mounted  on  the  right  hand  top  of  the  segment,  and  a 
dual  side  arm  hand-size  controller.  The  controllers  were  evaluated  by  the 
pilots  while  performing  various  up-and-away  and  approach  flight  maneuvers. 

A B-26  variable  stability  airplane  was  mechanized  to  simulate  the  character- 
istics of  a B-1  type  airplane  In  three  task  flight  phases.  The  primary 
objective  of  the  study  was  to  determine  the  relative  merits  of  the  controller 
concepts  In  an  overall  airplane  mission  oriented  environment.  The  study 
concluded  that  the  dual  side-arm  controller  configuration  is  the  most  prom- 
ising for  future  application. 

Reference  72  recommends  that  the  ARCS  control  panel  be  located  on  the 
left  hand  console  just  aft  of  the  throttle  quadrant  for  aircraft  with  con- 
trol sticks  such  as  the  F-12  series  aircraft.  This  reference  Includes  a 
description  of  the  manual  and  automatic  FCS  of  the  F-12  series  aircraft  and 
the  design  philosophy  utilized  In  the  design  of  the  control  system  Is 
reviewed . 

Reference  73  contains  a good  survey  of  the  various  approaches  to  the 
design  of  primary  hand  controllers. 

One  FCS  control  panel  Implementation  approach  which  provides  means  to 
manage  the  AFCS  functions  includes: 

I 

The  AFCS  engage/disengage  switch  should  provide  the  means  for 
engaging  and  disengaging  the  automatic  control  function.  The  switch  should 
be  mechanically  or  electrically  interlocked  in  nhe  OFF  condition  until  all 
engage  interlock  requirements  are  satisfied.  Flight  director  command  signals 
•should  operate  Independently  of  the  engage/disengage  switch. 

The  mode  select  switches  should  function  p note  switching 
devices  to  control  the  operational  modes  of  the  AFCb.  ihe  mode  select 
switches  should  allow  simultaneous  engagement  of  compatible  modes  and  should 
be  mechanically  and/or  electrically  interlocked  to  prevent  simultaneous 
engagement  of  incompatible  modes. 

Parameter  select  controls  should  provide  the  following  capability 
for  pilot-assist  modes  having  preselect  capability. 

(a)  Ability  to  preset  the  selected  reference  parameter  value  prior 
to  mode  engagement . 

(b)  Ability  to  have  the  selected  parameter  synchronized  with  the 
existing  conditions  prior  to  mode  engagement  so  that  the  existing  condition 
is  held  upon  mode  engagement. 

(c)  Ability  to  update  the  selected  reference  parameter  during 
operation  of  the  mode. 
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Parameter  select  controls  should  provide  capability  for  setting 
parameter  values  as  required  by  the  AFCS  guidance  modes.  The  parameter 
setting  device  should  be  simple  to  use  and  the  value  selected  shall  be 
continuously  displayed. 

3. 2. 1.2  Pilot  controls  for  rotary-wing  aircraft.  The  pilot's  cockpit  con- 
trols shall  be  designed  and  located  in  accordance  with  the  appl ^cable 
portions  of  AFSC  Design  Handbook  DH  2-2,  DN  2A1,  SN  1(2),  MS  33572,  MIL- 
STD-250,  and  the  following  subparagraphs.  Strict  adherence  to  the  prescribed 
location  and  range  of  motions  of  these  controls  is  required.  If  a cont 'ol 
stick  is  removable,  it  shall  be  positively  latched  in  place  when  installed. 

It  shall  be  possible  to  install  the  stick  only  in  the  correct  manner,  and 
suitable  means  shall  be  provided  to  prevent  rotation  of  the  stick.  Direc- 
tional pedals  shall  be  interconnected  to  insure  positive  movement  of  each 
pedal  in  both  directions. 

3 . 2 . 1 . 2 . 1 Interconnection  of  collective  pitch  controJ.  and  throttle  (s)  for 
helicopters  powered  by  reciprocating  engine (s).  The  collective  pitch  control 
shall  be  Interconnected  with  the  throttle  control  (s)  and  synchronized  to 
provide  the  proper  throttle  setting(s)  as  collective  pitch  is  increased  or 
decreased.  Means  shall  also  be  provided  to  permit  throttle  control,  inde- 
pendent of  collective  pitch  lever  movement,  by  rotation  of  the  grip  on  the 
lever . 


3 . 2 . 1 . 2 . 2 Interconnection  of  collective  pitch  control  and  engine  power  con- 
trols for  helicopters  powered  by  turbine  engine (s).  An  engine  power  level 
control  lever  shall  be  provided  for  each  engine.  The  power  level  control 
lever  shall  have  three  discrete  positions:  off,  idle,  and  fly,  which  shall 
establish  three  operating  ranges  of  engine  power.  A fourth  optional  dis- 
crete position  may  be  incorporated  to  provide  a contingency  emergency 
power  level.  The  collective  pitch  controller  may  be  interconnected  with 

the  engine  power  control  such  that  (for  a given  power  level  control  position) 
It  establishes  the  approximate  power  being  delivered  to  the  rotor,  and  also 
signals  power  level  changes  in  maneuvering  flight  to  minimize  transient 
rotor  speed  droop  and  overspeed.  Rotor  speed  select  control  shall  be  pro- 
vided on  the  collective  pitch  controllers.  Individual  engine  power  trim 
or  power  turbine  speed  trim  controls  may  be  located  on  the  collective 
pitch  controllers  or  on  the  engine  power  level  control  panel. 

3. 2. 1.2. 3 Alternate  or  unconventional  controls.  If  pilot's  controls  other 
than  the  conventional  center  located  cyclic  pitch  sticks,  left-hand  side 
located  collective  pitch  sticks,  directional  pedals,  control  system  power 
boost  controls,  automatic  flight  control  system  controls,  and  trim  controls 
specified  in  MIL-STD-250  are  utilized,  demonstration  to  the  satisfaction  of 
the  procuring  activity  of  their  accuracy  and  suitability  is  required. 

DISCUSSION 

A helicopter  pilot  normally  flies  with  hands  on  the  controls  due  to  the 
dynamics  of  the  aircraft  and  the  requirements  of  various  helicopter  missions. 
Temporary  locking  of  the  thrust  lever  or  collective  pitch  controller  will 
free  his  left  hand  to  operate  switches  on  the  console,  etc. 
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It  has  evolved  that  the  rotary-wing  aircraft  pilot  sits  in  the  right- 
hand  seat,  which  is  probably  the  major  departure  from  fixed-wing  aircraft 
design  practice.  The  second  significant  difference  is  in  the  force  level 
of  the  controls.  Helicopter  control  forces  are  significantly  lighter  than 
for  fixed-wing  aircraft  because  of  the  delicate  requirements  of  hover  mode 
operation.  Frequently,  however,  helicopters  are  fitted  with  maneuvering 
force-feel  systems  which  become  effective  in  forward  flight. 

The  helicopter  industry  has  remained  with  the  center  stick  and  pedals 
because  of  the.  obvious  awkward  nature  of  handling  a control  wheel  in  hover. 
Tlie  pedals  on  older  helicopters  traveled  in  circular  arcs.  The  recent  trend 
is  to  make  their  travel  more  straight,  which,  however,  complicates  the 
linkage  somewhat. 

The  thrust  lever  has  frequently  been  a cause  of  pilot-induced  vertical 
oscillations  because  its  up  and  down  m.. ‘•ion  is  in  the  same  sense  as  that  of 
the  aircraft  and  therefore  requires  careful  attention  to  damping  and  force 
level.  Recent  development  programs  with  electrical  flight  controls  and 
advanced  flight  control  concepts  have  provided  limited  evaluations  of  side 
arm  controllers.  It  is  apparent  that  a considerable  amount  of  effort  is 
required  to  make  these  acceptable  for  production  rotary  wing  aircraft. 

3.2. 1.3  Pilot  controls  for  S'fOL  aircraft.  Pilot's  cockpit  controls  for 
short  takeoff  and  landing  (STOL)  aircraft  shall  be  designed  and  located  in 
accordance  with  the  requirements  specified  in  3. 2. 1.1,  and  subsections,  for 
CTOL  aircraft,  and  MIL-F-83300  for  V/STOL  aircraft  as  applicable. 

DISCUSSION 

There  is  a need  to  retain  as  much  commonality  as  practical  between 
cockpit  controls  for  STOL  and  CTOL  aircraft  to  minimize  the  possibilities 
of  pilot  control  error.  Recognizing  that  it  is  too  early  in  the  development 
history  of  STOL  aircraft  to  specify  firm  requirements,  the  tentative  require 
ments  that  follow  are  included  to  provide  guidance.  They  are  based  on  pre- 
liminary design  studies  of  potential  STOL  aircraft  types  but  have  not  yet 
been  verified  by  actual  use.  If  design  or  other  factors  related  to  a speci- 
fic new  STOL  aii'craft  lead  to  alternate  designs,  they  should  be  pursued  and 
coordinated  with  the  procuring  activity  for  approval. 

Thrust  vector  control (s)  for  powered-lift  fixed-wing  STOL  aircraft 
For  aircraft  with  vectorable  engine  thrust  controlled  by  a cockpit  lever,  or 
levers,  the  thrust  vector  control  lever  (s)  should  meet  the  following  require 
ments  as  applicable: 

a.  For  single  seat  or  tandem  cockpits,  and  side-by-side  fighter 
cockpits  with  the  throttle  on  the  left-hand  side,  the  thrust  vector  lever 
should  be  located  just  to  the  right  (inboard)  of  the  throttle  lever (s)  and 
approximately  on  the  same  axis . 

b.  For  side-by-side  cockpits  with  throttles  on  a center  console, 
the  thrust  vector  levers  should  be  located  adjacent  to  the  throttle  lever  (s) 
such  that  they  can  be  easily  controlled  by  either  pilot. 
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c.  The  angular  travel  of  the  thrust  vector  control  lever (s) 
should  be  approximately  equal  to  the  angular  travel  of  the  throttle  lever (a) 
from  flight  idle  to  maximum  thrust.  Forward  lever  movement  should  direct 
engine  thrust  aft  and  result  in  forward  aircraft  acceleration,  and  aft  move- 
ment should  direct  thrust  down  and  result  in  increased  upward  fo’i'ces  on  the 
aircraft. 


d.  The  thrust  vector  lever (s)  should  have  feel  characteristics 
similar  to  the  throttle  lever (s).  Friction  should  hold  the  thrust  vector 
control  in  any  set  position,  and  the  breakout  force  should  be  no  more  than 
3+1  pounds. 


e.  Thrust  vector  lever(s)  should  be  designed  and  located  so  that 
they  may  be  moved  by  the  pilot  (or  copilot)  with  one  hand  in  a single  motion 
simultaneously  with  the  throttle (s)  such  as  for  a go-around. 

f.  The  transition  from  one  set  of  controls  to  another  set  should 
be  smooth  and  should  not  cause,  undesirable  transients. 

g.  Loss  of  one  engine  should  not  prevent  control  of  vector  con- 
trols on  the  remaining  operable  engine. 

Speed  conimand  control  (a)  for  powered-lift  fixed-wing  STOL  aircraft 
with  engine  controls  integrated  with  longitudinal  aerodynamic  controls.  For 
aircraft  with  a speed  control  system  with  engine  controls  integrated  with 
longitudinal  aerodynamic  control  for  use  in  the  STOL  flight  mode,  the  cock- 
pit speed  controller  should  consist  of  a speed  comm:..nd  lover  or  lever (s)  as 
follows: 


a.  For  single-seat  or  tandem  cockpits,  and  side-by-side  fighter 
cockpits  with  the  throttle  on  the  left-hand  side,  the  speed  command  lever 
should  be  located  just  to  the  right  (inboard)  of  the  throttle  lever (s)  and 
approximately  on  the  same  axis. 

b.  For  side-by-side  cockpits  with  throttles  on  a center  console, 
the  speed  command  levers  should  be  located  adjacent  to  the  throttle  lever (s) 
such  that  they  can  be  easily  controlled  by  either  pilot. 

c.  The  angular  travel  of  the  speed  command  lever  (s)  should  be 
approximately  equal  to  the  angular  travel  of  the  throttle  lever  (s)  from 
flight  idle  to  maximum  thrust.  Forward  lever  movement  should  command 
Increased  speed,  and  aft  movement  decreased  speed. 

d.  The  speed  command  lever (s)  should  have  feel  characteristics 
similar  to  the  throttle  lever (s).  Friction  should  hold  the  speed  command 
control  in  any  set  position  and  the  breakout  force  should  be  3 + 1 pounds. 

e.  Speed  command  lever (s)  should  be  designed  and  located  so  that 
they  may  be  moved  by  the  pilot  (or  copilot)  with  one  hand  in  a single  motion 
simultaneously  with  the  throttles  such  as  for  a go-around. 

f.  The  speed  command  control(s)  and  throttle  control (s)  should  be 
designed  such  that  the  latter  can  override  the  former  for  reversion  to  the 
contentioral  flight  mode. 


g.  The  Incorporation  of  the  speed  command  control  should  not 
Interfere  with  the  normal  relationship  of  the  throttle  lever (s)  and  the 
engine  fuel  control (s). 

h.  The  transition  from  one  set  of  controls  to  another  set  should 
be  smooth  and  not  cause  undesirable  transients. 

Lift  vector  control(s)  for  powered-left  fixed-wing  STOL  aircraft, 
with  flap  controls  integrated  with  thrust  vector  controls.  For  such  air- 
craft, the  cockpit  lift  vector  control,  for  use  in  STOL  flight  should  con- 
sist of  a lift  vector  command  lever  or  lever (s)  as  follows: 

a.  For  single-seat  or  tandem  cockpits,  the  lift  vector  control 
lever  should  be  located  Just  to  the  right  (inboard)  of  the  throttle  lever (s) 
and  on  the  same  axis. 

b.  For  side-by-side  cockpits,  the  lift  vector  control  levers 
should  be  located  adjacent  to  the  throttle  lever (s)  such  that  they  can  be 
easily  controlled  by  either  pilot. 

c.  The  angular  travel  of  the  lift  vector  control  lever (s)  should 
be  approy"  ,aly  equal  to  the  total  angular  travel  of  the  flap  position 
control  i , Forward  lever  movement  should  command  decreased  magnitude  of 
the  lift  v<  .or,  and  aft  movement  should  command  Increased  magnitude  of  the 
lift  vector 


d.  The  lift  vector  control  lever (s)  should  have  feel  character- 
istics similar  o the  throttle  lever (s).  Lever  friction  should  hold  it  in 
any  set  positio  .,  and  the  manual  override  (breakout)  force  should  be  3 + 1 
pounds. 


e.  Lift  vector  control  lever (s)  should  be  designed  and  located 
so  chat  they  may  be  moved  by  the  pilot  (or  copilot)  with  one  hand  in  a 
single  motion  simultaneously  with  the  throttles  such  as  for  a go-around. 

f.  The  flap  control  lever  should  be  mechanized  to  track  the  flap 
position  command  when  the  lift  vector  control  lever (s)  is  (are)  in  use. 

g.  In  conventional  flight  modes,  the  lift  vector  control  lever (s) 
should  command  thrust  vector  orientation. 

h.  The  transition  from  one  set  of  controls  to  another  set  should 
be  smooth  and  not  cause  undesirable  transients- 

3. 2. 1.4  Pilot  displays. 

3.2. 1.4.1  FCS  annunciation.  The  FCS  control  panel  or  associated  panels 
shall  provide  means  to  display: 

a.  aFCS  engaged. 

b Mode  engaged. 

c.  That  automatic  mode  switching  has  occurred — if  required. 

d.  Preselected  values  for  selectable  mode  parameters. 
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3.2.1, 4.2  KCS  warning  and  status  annunciation.  FCS  warning  and  status 
aniiunoiation  shall  be  provided  lii  the  cockpit.  Annunciation  shall  be 
designed  to  clearly  Indicate  the  associated  degree  of  urgency, 

a.  First  degree-~linmedl;Ate  action  required  (warning  may  be 

audible).  * 

b.  Second  degree — (’autlon,  action  raay  be  required. 

c.  Third  degree— Inf ormatlonal , no  immediate  action  required. 

A panel  comprising  means  for  displaying  first  degree  annunciations  shall  be 
located  within  the  normal  eye  scan  range  of  the  command  pilot.  A first 
degree  warning  or  status  indication,  wliich  applies  only  to  a particular 
mode  or  phase  of  flight,  sl\all  be  inhibited  or  designed  to  clearly  indicate 
a lesser  degree  of  urgency  for  all  other  modes  or  phases  of  flight. 

3. 2. 1,4. 2.1  Preflight  test  (Bit)  status  annunciation.  If  BIT  is  used,  this 
display  shall; 


a.  Indicate  the  progress  of  the  preflight  test., 

b.  Instruct  the  crew  to  provide  required  manual  inputs. 

c.  Indicate  lack  of  system  readiness  when  failure  conditions  are 

detected. 

3.2. 1.4.2. 2 Failure  status.  Failure  warnings  shall  be  displayed  to  allow 
the  crew  to  assess  the  operable  status  of  redundant  or  monitored  flight 
control  systems.  Automatic  disengagement  of  an  AFCS  mode  shall  be  indicated 
by  an  appropriate  warning  display,  hfanual  disengagement  by  the  crew  shall 
not  result  In  warning  annunciation. 

3. 2. 1.4. 2. 3 Control  authority  annunciation.  If  available  manual  control 
authority  can  be  reduced  below  the  level  required  for  maneuver  control  by  a 
function  such  as  automatic  trim  or  stability  augmentation,  pilot  displays 
shall  be  provided  to  indicate  available  control  authority  for  essential  and 
flight  phase  essential  FCS.  Warning  .shall  be  provided  if  remaining  manual 
control  becomes  critical. 

3.2. 1.4. 3 Lift  and  drag  device  position  indicators.  Indicators  shall  be 
provided  In  the  cockpit  to  indicate  to  the  pilot  (s)  the  position  of  each  lift 
or  drag  device  having  a .separate  control.  They  shall  also  Indicate  the  cor- 
rect takeoff,  euroute,  approach,  and  landing  positions;  and,  if  any  extension 
of  the  lift  and  drag  devices  beyond  the  landing  position  is  possible,  the 
indicators  shall  be  marked  to  identify  the  range  of  extension.  In  addition, 
an  indication  of  unsymmetrical  operation  or  other  malfunction  in  the  lift  or 
drag  device  systems  shall  be  provided  whenever  necessary  to  enable  the 
pilot  (s)  to  prevent  or  counteract  an  unsafe  flight  or  ground  condition. 

3. 2. 1.4. 4 Trim  indicators.  Suitable  indicators  shall  be  provided  to: 
a.  Indicate  the  position  and  the  range  of  travel  of  each  trim 

device . 
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b.  Indicate  the  direction  of  the  control  movenent  relative  to 
the  airplane  notion. 

c.  Indicate  the  position  of  the  trim  device  with  respect  to  the 
range  of  adjustment.  (Trim  devices  such  as  the  magnetic  brake  used  in 
helicopters  co  Instantaneously  relieve  pilot's  control  forces  by  changing 
the  feel  force  reference  to  zero  at  the  control  position  held  by  the  pilot 
at  the  time  the  trim  switch  is  activated  shall  not  require  separate  trim 
indicator. ) 


d.  Provide  pilot  warning  of  trim  failures  which  could  result  in 
exceeding  the  State  III  requirements  of  3. 1.3. 3. 4. 

Aircraft  which  require  takeoff  longitudinal  trim  setting  in  accordance  with 
eg  location  shall  have  suitably  calibrated  trim  position  indicators.  Where 
suitable,  trim  indicators  shall  be  in  accordance  wit'i  MIL-I-7064.  In  air- 
craft requiring  quick  takeoff  capability  or  certain  single  pilot  aircraft, 
which  use  a single  trim  setting  for  all  takeoff  conditions,  a trim  for  take- 
off light  shall  be  provided. 

3. 2. 1.4. 5 Control  surface  position  indication.  Indicators  shall  be  provided 
in  the  cockpit  for  all  control  surfaces  whose  positions  are  indicative  of 
potential  flying  qualities  below  Level  3,  when  the  cockpit  controls  do  not 
provide  a positive  indication  of  long  term  or  steady  state  control  surface 
position,  or  where  the  effects  of  control  surface  positioning  is  not  readily 
detectable  by  other  means. 

DISCUSSION 

The  following  general  considerations  apply  to  systems  designed  for 
redundant  operations — typified  by  the  all  weather  landing  system: 

The  crew  should  be  aware  of  Che  operational  status  of  the  landing 
system,  by  annunciation  of  modes  or  warning  chat  action  is  required.  It  is 
desirable  that  three  categories  of  warning  be  provided  to  the  flight  crew 
so  that  immediate  attention  to  a problem  is  demanded  only  in  the  event  of  a 
critical  condition,  e.g.,  failure  of  a necessary  system  at  low  altitude. 

The  three  categories  of  warning  are  defined  in  terms  of  the  associated 
degree  of  urgency  for  responsive  action. 

a.  Immediate  Action  Required — loss  of  system  function,  hazard- 
ous condition  imminent.  An  example  of  this  situation  might  be  taken  as 
total  loss  of  the  AFCS  at  low  altitudes  during  a limited  visibility  approach. 

b.  Caution,  Action  may  be  Required — probable  loss  of  system 
function.  Hazardous  condition  may  be  developing.  Pilot  should  make  an 
assessment  of  system  status  before  responding. 

c.  Informational,  No  Immediate  Action  Required — possible  loss 
of  system  function  in  near  future.  No  impending  hazard.  An  example  is 
pretest  of  a system  identifying  a failure.  Hazard  can  be  avoided  by 
avoiding  use  of  that  system  or  mode. 
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The  probability  of  loalng  the  capability  to  iaolata  failures  and 
annunciate  aysteo  atatua  ahould  be  ainlnised.  Thia  nay  require  special 
considerations  relative  to  power  aourca  selection.  For  exaaple,  if  fail- 
ures are  annunciated  by  lightSi  then  the  design  must  ensure  power  to  the 
lights  when  the  channel  failure  is  a power  failure. 

The  probability  of  the  crew  nlsisanaging  a safety-critical  system 
should  be  minimised.  Zealous  pursuit  of  this  objective  can  lead  to  criteria 
which  require  that  interlock  logic  be  inpleraented  that  prevents  the  crew 
from  isolating  a critical  channel  unless  the  channel  has  been  annunciated 
as  failed,  and  which  prevent  the  crew  from  re-engaging  critical  channels 
that  have  been  isolated  due  to  a prior  failure  Indication, 

The  system  design  should  allow  smoke  clearing  procedures  so  that 
the  crew  can  safely  cut  power  to  any  electrical  box  which  might  produce 
obnoxious  amounts  of  smoke  and  fumes. 

The  annunciation  and  control  functions  should  be  implemented  so 
that  it  is  not  possible  to  propagate  failures  or  false  failure  annunciations 
across  the  redundant  channels. 

Wire  runs,  cable  runs,  and  cross-channel  cabling  should  be  mini- 
mized, 

SinC';;  the  annunciation  and  control  box  may  be  coimuon  to  all  channels, 
special  precaution  may  be  required  to  protect  against  injury  to,  or  destruc- 
tion of,  this  box  causing  loss  of  cll  operating  channels. 


Reference  12  describes  the  design  trades  performed  to  develop  the  pilot 
displays  for  the  American  SST.  Specific  options  considered,  the  packaging 
design  used  and  conclusions  reached  are  discussed. 

The  requirement  to  annunciate  manual  control  authority  when  masked  by 
automatic  trim  is  in  response  to  aircraft  lost  due  to  loss  of  pitch  control. 

An  F-111  was  lost  following  a failure  in  the  fuel  transfer  system  which 
caused  an  aft  eg  condition  to  develop.  The  series  autotrim,  which  is  part 
of  the  F-111  augmentation,  maintained  the  stick  in  the  trimmed  position  and 
the  stabil.^ty  augmentation  masked  the  degrading  pitch  stability.  As  air- 
speed was  reduced  and  control  limits  were  reached,  the  F-111  went  out  of 
control  and  was  lost.  Reference  6. 

Runaway  trim  has  caused  many  accidents  in  the  past.  Many  of  these 
accidents  occurred  because  the  pilot  was  not  aware  of  the  malfunction  until 
it  was  too  late.  Low  altitude,  night  and  instrument  conditions  affect  the 
pilot's  capability  to  detect  and  react.  Commercial  transport  aircraft  provide 
an  aural  warning  whenever  pitch  trim  is  changing.  Such  a device  is  highly 
desirable,  particularly  if  a single  failure  can  result  in  runaway  trim. 

3.2.2  Sensors.  Sensors  shall  be  installed  in  locations  which  allow  adequate 
sensing  of  the  desired  aircraft  and  flight  control  system  parameters,  and 
which  minimize  exposure  to  conditions  which  could  produce  failures  or  un- 
desired output  signals. 
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Careful  attantlon  muat  b«  given  to  the  locition  and  detail  Inatallatlon 
of  all  aenaora  to  eniure  that  they  provide  oignala  of  the  quality  necessary 
for  the  flight  control  ayiten  without  distortion  due  to  undesirable  struc- 
tural modea  or  other  effects.  The  locations  muat  not  be  such  as  to  subject 
the  aenaora  to  damage  or  change  of  output  characteriaticc  due  to  environ- 
mental conditions,  and  muat  be  accessible  for  inspection,  removal,  and 
reinatallation  b>  maintenance  personnel.  Redundant  air  data  sensors,  for 
example,  can  cause  problems  because  of  natural  variations  in  local  flow 
fields  with  angle  of  attack  and  sideslip. 

Reference  12  describes  the  sensor  selection  trades  considered  for  the 
American  SST  which  determined  the  type  of  oensot  to  be  used  and  the  preferred 
locations  for  these  sensors. 

3.2.3  Signal  transmission 

3 . 2 . 3 . 1 General  reQuirements. 

3. 2. 3. 1.1  Control  element  routing.  Within  the  restrictions  and  requirements 
contained  elsewhere  in  this  specification,  all  portions  of  signal  trans- 
mission subsyacems,  including  cables,  push-pull  rods,  torque  tubes,  and  elec- 
trical wiring  shall  be  routad  through  the  airplane  in  the  most  direct  manner 
over  the  shortest  practical  distances  between  points  being  connected,  Pro- 
tection from  use  as  steps  or  handholds  shall  be  provided. 

DISCUSSION 

Considerable  care  must  be  taken  in  the  design  of  control  signal  trans- 
mission installations  in  order  to  meet  the  foregoing  requirements.  These 
and  many  other  considerations,  such  as  the  ability  to  provide  the  required 
signal  transmloslon  accuracy,  fitting  the  components  into  the  space  available, 
and  obtaining  minimum  weight,  go  into  the  selection  of  signal  transmission 
elements  for  a given  aircraft.  Pertinent  requirements  specified  elsevdtere 
in  this  specification  ranked  in  an  order  of  most  to  least  important  include; 

Suitable  system  separation  and  clearance  which  precludes  contact 
with  structure  and  other  equipment,  plpinc,  wiring,  and  controls  under  all 
operating  extremes  is  needed.  (3. 2. 3. 1.2) 

Single  failure  points  where  failure  is  not  extremely  remote  must 
be  avoided.  (3.K3) 

Protection  from  adverse  natural  and  induced  environments  including 
lightning,  static  electelclty,  and  mechanical  damage  is  needed.  (3.1.9) 

Suitable  access  for  maintenance  roust  be  provided  and  interference 
with  access  to  other  i^ystems,  equipment  and  adjustment  devices  must  be 
avoided.  (3.1.10.3) 

Control  elements  routing  should  be  determined  early  in  the  design  of 
an  aircraft  before  "freezing"  the  location  of  equipment  which  could  comprom- 
ise the  control  routing. 
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3. 2. 3. 1.2  Sy»fw  ■■paftlon,  prottction,  •nd  cltafnct.  Wh«re  redundant 
cable,  puahrod,  or  electrical  tr'«'ing  are  provided,  they  ahall  be  separated 
aa  r«.quired  to  neat  the  invulner«tbility  requirementa  of  3.1.9.  Advantage 
ahall  be  taken  of  the  shielding  afforded  by  heavy  structural  members, 
existing  armor  plate,  or  other  equipment  for  the  protection  of  important 
components  of  the  control  systems.  Clearance  between  flight  control  system 
components  and  structure  or  other  components  shell  be  provided  as  necessrry 
to  Insure  that  no  probable  combination  of  temperature  effects,  air  loads, 
structural  deflections,  vibrations,  buildup  of  manufactnring  tolerances,  or 
wear,  can  cause  binding  or  jamming  of  any  portion  ot  the  control  system, 
tn  locally  congested  areas  only,  the  following  minimum  clearances  may  be 
used  after  all  adverse  effects  are  accounted  for: 

a.  1/8-lnch  between  static  elements  except  those  within  an  LRU 
where  closer  clearances  can  be  maintained  or  where  contact  cannot  be 
detrimental. 


b.  1/8-inch  between  elements  which  move  in  relation  to  each  other 
and  which  arc  connected  to  or  are  guided  by  the  same  structural  or  equipment 
element  (s)  except  those  within  an  LRU  where  closer  clearances  can  be  maln-> 
tained  or  where  contact  cannot  be  detrimental. 

c.  l/A-'inch  between  elements  which  move  in  relation  to  each  other 
and  which  are  connected  to  or  are  guided  by  different  structural  or  equipment 
elements. 


d.  1/2-inch  between  elements  and  aircraft  structure  and  equipment 
to  which  the  elements  are  not  attached. 

DISCUSSION 

The  minimum  clearances  specified  above  are  based  upon  uxperlence  and  are 
listed  in  the  descending  order  shown  based  upon  the  relative  probability  that 
the  elements  will  retain  their  selected  positions  from  aircraft  to  aircraft. 
Every  effort  should  be  made  to  avoid  the  minimum  spacings,  however;  and  it 
should  be  noted  that  the  rnlnimums  listed  are  the  clearances  which  must  be 
provided  after  all  of  the  adverse  effects  (e.g.,  loads,  deflections,  vibra- 
tions, tolerances,  wear,  etc.)  are  accounted  for. 

As  a general  objective,  control  elements  should  clear  items  uf  equip- 
ment, structure,  electric  wire  runs  and  hydraulic  and  pneumatic  lines  by 
2.0  Inches,  wt:erc  possible. 

3. 2. 3. 1.3  Fouling  prevention.  All  elements  of  the  flight  control  system 
shall  be  designed  and  suitobly  protected  to  resist  jamming  by  foreign  objects. 

DISCUSSION 

This  is  a most  important  requirement.  Lives  have  been  lost  because 
foreign  objects  have  jammed  controls  and  caused  crashes,  unplanned  ejections, 
and  other  unsafe  events.  There  have  been  several  instances  of  control  Jams 
because  of  tools,  screws,  bolts,  nut  strips,  and  other  objects  binding 
flight  control  mechanisms.  Hany  such  events  are  documented  in  Reference  A6, 
including  one  wliere  an  aircraft  loss  was  attributed  to  a Jammed  pltch/roll 
mixer  by  a tube  of  fuel  tank  sealant  found  in  the  wreckage. 
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Mochanlsms  and  Installations  should  be  designed  to  preclude  Jamming  by 
foreign  objects,  Compact  Installations  of  parallel  rods  and  adjacent  bell- 
cranks  may  have  an  orderly  appearance  but  present  many  opportunities  for 
Jamming.  Clearances  between  control  paths  should  be  determined  by  the 
dimensions  of  the  tools  and  related  Items  moat  likely  to  be  used  in  main- 
taining and  Inspecting  the  area.  Many  cases  of  Jamming  by  flashlights 
and  screwdrivers  have  been  identified.  Moving  elements  of  control  systems 
should  be  located  near  the  top  surface  of  their  enclosures.  The  supporting 
elements  should  be  designed  so  that  they  cannot  trap  a tool  or  other 
foreign  object.  Protection  provisions  should  also  consider  the  effects  of 
inverted  flight  in  fighter/attack  type  aircraft  and  aero  or  negative  "g" 
flight  in  all  aircraft  as  may  be  Introduced  intentionally  or  caused  by 
turbulence. 

In  areas  where  a great  amount  of  maintenance  Is  required,  a permanently 
attached  cover  should  be  Installed  on  pulley  brackets  and  complex  mechanisms 
to  prevent  foreign  objects  such  as  rags,  nuts,  bolts,  etc.,  from  lodging 
between  cable  and  pulley  groove  and  In  linkage  so  as  to  Jam  the  control 
system.  In  all  locations,  vertical  or  near  vertical  pulliiys  should  be 
equipped  with  guards.  In  unpressurized  sections,  the  design  of  mechanisms 
including  pulley,  sector,  and  drum  support  structure  nust  be  such  as  to 
prevent  slush  and  ice  accumulation  from  Jamming  the  control  system. 

These  recommendations  should  be  strongly  considered  even  if  they  require 
additional  space  for  control  runs.  In  a fly-by-wire  system,  the  mechanical 
portion  would  be  much  simpler  and  Include  fewex  points  which  could  be  Jammed. 
It  would  be  easier  to  reduce  mechanical  density,  include  proper  Inspection 
panels,  and  take  other  steps  to  reduce  opportunities  for  tool  and  other 
foreign  object  Jamming. 

3. 2, 3.1. A Rigging  provisions.  The  number  of  rigging  positions  shall  be  kept 
to  a practical  minimum.  They  shall  be  readily  accessible  and  located  where 
space  for  the  rigging  function  is  avaxlable.  Installed  rigging  pins  shall 
be  highly  visible  from  the  ground  or  Include  streamers  as  specified  in 
3. 1.10. A.  Control  cirface  actuator  outputs  shall  not  be  rig  pinned. 


DISCUSSION' 

The  m.  ..xmization  of  rigging  errors  Justifies  the  additional  engineering 
effort  and  tooling  precision  which  may  be  required  to  achieve  adequate  adjust- 
ment of  the  signal  transmission  system  with  a minimum  number  of  rig  positions. 
The  use  of  streamers  is  important  to  minimize  the  possibility  of  clearing  an 
aircraft  for  flight  before  the  rig  pins  are  removed. 

3. 2. 3.2  Mechanical  signal  transmission 

3. 2. 3. 2.1  Load  capability.  Elements  of  mechonical  signal  transmission  systems 
subjected  to  loads  generated  by  the  pilot (s)  shall  be  capable  of  withstanding 
the  loads  due  to  pilot's  input  limits  specified  in  MIL-A-8865,  Section  3.7, 
Flight  Control  System  Loads,  taken  as  limit  loads,  unless  higher  loads  can  be 
imposed  such  as  by  a powered  actuation  system  or  loads  resulting  from  aero- 
dynamic forces.  Where  higher  loads  are  thusly  imposed,  they  shall  be  met  with 
the  same  margins  and  circumstances  as  specified  in  MIL-A-8865. 


119 


3. 2. 3. 2. 2 Strength  to  clear  or  override  lammed  hydraulic  valves.  All  mech- 
anical elements  which  transmit  input  commands  to  metering  valves  of  hydraulic 
servoactuators  shall  have  strength  to  withstand  higher  loads,  above  those  for 
normal  valve  stroking,  required  to  clear  foreign  material  that  may  occur  in 
projected  usage. 

3. 2. 3. 2. 3 Power  control  override  provisions.  Provisions  shall  be  made  to 
permit  the  pilot (s)  to  clear  or  override  metering  valve  jams  unless  there  is 
sufficient  aerodynamic  control  power  from  the  remaining  operative  surfaces  to 
override  control  moments  generated  by  the  jammed  surface  in  its  most  adverse 
position. 

DISCUSSION 

Specific  values  for  valve  jam-clearing  forces  depend  upon  the  specific 
valve  designs  and  the  system  design  approach.  On  many  hydraulic  metering 
valves,  a 200-pound  force  will  be  sufficient  to  shear  all  chips  or  other 
foreign  material  which  could  jam  a valve.  On  others,  especially  those  with 
tapered  metering  slots  where  a chip  might  become  wedged,  more  force  may  be 
required.  In  systems  where  detented  linkage  is  used  to  allow  override  of 
a jammed  valve,  the  maximum  detent  breakout  force,  considering  all  adverse 
tolerances,  must  be  considered. 

An  alternate  to  this  requirement  is  to  use  a dual-concentric-spool 
valve,  such  as  used  on  a number  of  commercial  jet  airliners,  which  allow 
continued  functioning  in  the  event  of  a solid  jam  of  one  spool  in  a mid- 
position  and  neutralization  of  a hardover. 

3.2. 3.2.4  Control  cable  Installations.  Control  Cable  i-.stallacions  shall 
be  designed  to  accommodate  easy  servicing  and  rigging,  and  tb'v  number  of 
adjustments  required  shall  be  kept  to  the  practical  miriuium. 

3.2. 3. 2. 4.1  Control  cable.  Cable  used  for  the  a-  tuation  of  flight  controls 
shall  be  the  most  suitable  of  the  following  types  for  each  application.  Use 
of  carbon  steel  or  other  type  cable  not  listed  below  requires  procuring 
activity  approval. 

a.  Flexible  ny? on-coated  corrosion-resisting  steel  wire  rope  in 
accordance  with  MIL-W-83420 . 

b.  Preformed  flexible  corrosion-resisting  steel  wire  rope  in 
accordance  with  MIL-W-83420. 

c.  Preformed  flexible  corrosion-resisting  nonmagnetic  steel  cable 
in  accordance  with  MIL-C-18375. 

DISCUS -ION 

Stain'.°CG  steel  cable  has  been  required  for  new  USAF  aircraft  designs 
since  che  issuance  of  MIL-F-9490C  in  1964.  Prior  to  that  time,  carbon-steel 
cablf:  per  MIL-W-83420  was  also  allowed  and  is  still  being  designed  into 
commercial  jet  aircraft,  including  many  purchased  for  USAF  use,  where 
corrosion  resistance  is  not  as  significant  as  for  many  military  aircraft. 
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In  addition  to  Its  corrosion  resistance,  tests  such  as  reported  in 
Reference  74  have  shown  that  the  fatigue  life  of  stainless  steel  cable  is 
superior  to  carbon  steel  cable  (either  galvanized  or  tin  coated),  espec- 
ially at  low  temperature  (-65“F  to  which  many  cables  are  exposed  ix\  flight). 
Other  tests  also  Indicate  its  superiority  at  higher  temperatures,  espec- 
ially in  corrosive  (salt  spray)  atmosphere. 

Stainless  steel  cable  is  not  Immune  to  failure  In  service,  however, 
and  there  has  been  a history  of  control  cable  failures  in  high  vibration 
areas  caused  by  excessive  wear  on  the  outer  wires  where  the  cables  make 
contact  with  the  falrleads.  At  one  time,  such  failures  in  fuselage-mounted 
cable  runs  in  F-5  and  T-38  aircraft  became  such  a serious  problem  that  cable 
replacements  were  required  after  as  low  as  40  hours  service. 

This  experience  led  to  the  evaluation  of  standard  stainless  steel  cable 
jacketed  with  extruded  plastic  materials.  In  the  test  program  documented  in 
Reference  75,  cable  jacketed  with  nylon  proved  superior  to  polyolefin  mater- 
ial and  was  adopted  for  standardization.  Its  use  on  the  F-5  and  T-38  air- 
craft has  completely  solved  the  failure  problem;  and,  of  10,000  installatiows, 
only  two  removals  (due  to  overheat  near  the  engine)  were  required. 

Use  of  nylon  jacketed  cable  (now  specified  by  MIL-W-83420)  has  also 
resolved  a similar  problem  on  C-141A  aircraft.  Replacement  of  bare  stainless 
steel  aileron  and  spoiler  control  system  cables,  subjected  to  aerodynamic 
Induced  vibration  in  the  wing,  has  been  required  in  as  few  as  400  flight 
hours  due  to  extreme  work  hardening  and  wear  adjacent  to  the  roller  fairleads 
In  most  cases,  1,500  hours  was  the  maximum  life  for  the  bare  cable;  but,  it 
now  appears  that  adoption  of  the  jacketed  cable  has  eliminated  this  problem. 

Similar  experience  has  been  had  with  certain  wing-mounted  carbon  steel 
cables  on  707  airliners.  They  are  now  furnished  to  the  airlines,  and  the 
USAF  AWACS  fleet,  with  nylon- jacketed  carbon  steel  cable  in  the  lateral 
control  system.  Bare  carbon  steel  is  still  used,  however,  and  provides 
acceptable  service  life. 

In  the  sizes  most  commonly  used  for  flight  control  applications,  1/8  and 
3/32-inch  nominal  diameter,  available  coating  thicknesses  (per  MIL-W-83420) 
are  as  follows: 


Nominal  Cable 

Nylon  Wall 

Nylon  Jacket 

Diameter 

Thickness 

Diameter 

3/32  .016  1/8 


3/32 

.031 

5/32 

1/8 

.031 

3/16 

The  .031  thickness  wears  better,  but  cable  with  .016  jacket  has  lower 
friction.  With  either  thickness,  friction  will  be  higher  than  with  uncoated 
cable.  See  MIL-W-83420  for  the  jacket  diameters  and  thicknesses  for  other 
sizes.  The  increase  in  diameter  due  to  the  jacket  must  be  considered  in  the 
design  of  cable  grooves  on  drums  and  sectors,  and  may  require  the  use  of  dif- 
ferent pulleys  than  used  for  unjacketed  cable. 
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The  requirement  that  approval  must  be  obtained  before  using  carbon 
steel  and  other  type  cable  Is  not  Intended  to  prohibit  their  use;  but, 
rather,  to  ensure  that  there  are  sound  technical  and/or  economic  reasons 
for  selection,  and  they  will  not  be  subject  to  failure  due  to  excessive 
wear,  fatigue,  or  corrosive  environments. 

One  reason  for  use  of  another  type  Is  to  reduce  cable  stretch  under 
load.  The  standard  7x7  and  7 x 19  construction  carbon-steel  cable  per 
MIL-W-83420  has  a modulus  of  elasticity  roughly  30  percent  greater  than  for 
standard  construction  stainless  steel.  Where  greater  stiffness  Is  required, 
special  1 X 19  construction  carbon-steel  cable  and  alinnlnum  clad  standard 
carbon  steel  and  stainless  steel  cable  can  be  considered. 

At  one  time,  there  were  few  vendors  equipped  to  make  acceptable  stain- 
less steel  cable,  and  the  price  was  considerably  greater  than  for  carbon 
steel.  This  situation  has  Improved,  however,  and  a realistic  comparison  of 
Initial  and  replacement  costs  should  be  made  before  assuming  which  will  be 
most  cost  effective. 

3.2. 3. 2. 4. 2 Cable  size.  Cable  shall  be  sized  to  meet  the  load  requirements 
of  the  system  with  ample  safety  factors  to  compensate  for  wear  and  deterior- 
ation where  pulleys,  falrleads,  etc.,  are  encountered.  Cable  size  shall 
also  be  adequate  In  regard  to  permissible  cable  stretch,  pulley  friction 
values,  and  other  variables  which  affect  system  performance.  Where  substan- 
tial loads  are  carried,  cables  shall  be  sized  so  that  limit  loads  do  not 
exceed  67  percent  of  the  rated  breaking  strength  of  the  cable  and  do  not 
exceed  the  maximum  cable  limit  loads  allowed  for  their  pulleys. 

DISCUSSION 

All  cables  must  have  a rated  breaking  strength  of  at  least  1.5  times 
design  limit  load.  In  addition,  the  size  selected  should  be  such  that 
maximum  limit  load  does  not  exceed  the  limitations  soeclfled  for  the 
selected  pulleys.  See  AFSC  Design  Handbook  DH  2-1,  DN  3B1,  Subnole  1.1. 2(1), 
"Standard  Pulleys,"  for  limitations  specified  for  cable  used  with  MS20219, 
MS20220,  and  MS20221  pulleys. 

3. 2. 3. 2. 4. 3 Cable  attachments.  The  minimum  practical  number  of  inter- 
connections shall  be  used  which  allow  all  cable  segments  to  be  connected 
manually.  Cable  disconnects  shall  be  located  and  designed  so  that  It  Is 
physically  impossible  to  mlsconnect  in  any  manner,  either  cables  in  the 
same  system  or  the  cables  of  different  systems.  Cable  disconnects  and  turn- 
buckles  shall  be  so  located  that  they  will  not  hang  up  or  interfere  with 
adjacent  structure  or  equipment  or  on  each  other  and  will  not  snag  on  cables, 
wires,  or  tubing.  Corrosion-resistant  steel  MS  swage-type  cable  fittings  in 
accordance  with  MIL-T-781,  swaged  to  form  cable  i assemblies  in  accordance 
with  MIL-T-6117,  shall  be  used  wherever  possible.  Thimble  ends  per  MIL-T- 
5677,  attached  to  cable  by  splicing  and  wrapping  in  accordance  with  MIL-S- 
5676,  may  be  used  In  applications  where  additional  Joints  are  needed  to 
prevent  bending  fatigue  failures.  Turnbuckles  used  in  flight  control  cables 
systems  shall  be  in  accordance  with  MIL»-T-8878.  Turnbuckle  and  fittings 
shall  be  designed  so  that  they  are  not  subject  to  bending  forces  which  can 
cause  fatigue  failures.  Turnbuckle  terminals  shall  not  have  more  than  three 
threads  exposed  at  either  end.  Ml  turnbuckle  assemblies  shall  be  properly 
safetied  In  accordance  with  MS33736. 


122 


DISCUSSION 


The  applicable  terminals  In  accordance  with  MIL~T-781  are  controlled 
by  the  following  standards; 


MS20658, 

MS20663, 

MS20664, 

MS20667, 

MS20668, 

MS21259, 

MS21260, 


Terminal, 
Ball  End, 
Ball  End, 
Terminal, 
Terminal, 
Terminal , 
Terminal, 


Wire  Rope, 
Wire  Rope, 
Wire  Rope, 
Wire  Rope, 
Wire  Rope, 
Wire  Rope, 
Wire  Rope, 


Swaging, 
Swaging, 
Swaging, 
Swaging , 
Swaging , 
Stud . 
Stud . 


Fork  End . 
Double  Shank. 
Single  Shank. 
Fork  End . 

Eye  End. 


These  standards  call  out  both  cadmium-plated  carbon  steel  and  cor- 
rosion-resistant steel,  but  only  the  latter  have  been  qualified. 

The  difference  in  the  MS20658  and  MS20667  fork  ,ypos  is  that  the 
former  are  sized  to  accommodate  an  MS27640  heavy-duty  ball  bearing  between 
the  tines,  whereas  the  latter  are  sized  to  accommodate  the  MS20668  eye  ends. 
The  difference  in  the  MS21259  and  MS21260  stud  types  is  that  the  latter  has 
a shorter  length  of  thread  on  the  threaded  end  and  also  comes  in  both  a 
short  and  a long  threaded  end. 


Note  that  there  are  two  types  of  terminals  as  follows: 

Type  I:  Sleeve  (or  shank)  terminals  which  are  the  regular  termin- 

als for  general  use  in  aircraft  control  cable  installations. 


Type  II:  Ball-end  terminals  for  use  in  ordnance  and  glider  con- 

trol installations  and  in  attaching  cables  to  quadrants,  drums,  etc,,  in 
cable  control  systems  on  powered  aircraft. 

A typical  thimble-end  connection  is  shown  on  MS33736  and  may  oe  used  to 
prevent  bending  fatigue  failures  as  shown  in  AFSC  Design  Handbook  DH  2-1, 

DN  3B1,  Subnote  1.2(1),  "Fatigue  Failure  Turnbuckle." 

Components  of  turnbuckles  in  accordance  with  MIL-T-8878  are  controlled 
by  the  following  standards: 

MS21251,  Turnbuckle  Body,  Clip  Locking. 

MS21252,  Clevis  End,  Turnbuckle,  Clip  Locking. 

MS21253,  Clevis  End,  Turnbuckle,  Clip  Locking  (for  Bearing). 

MS212.54,  Eye  End,  Turnbuckles,  Clip  Locking  (for  Pin). 

MS21255,  Eye  End,  Turnbuckle,  Clip  Locking  (for  Wire  Rope) 

MS21256,  Clip,  Locking,  Turnbuckle. 

MS33736  specifies  methods  of  safetying  turnbuckle  components  with  the 
MS21256  locking  clips. 
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3. 2. 3. 2. 4. 4 Cable  routing.  Control  cables  shall  be  arranged  in  parallel 
runs,  and  be  accessible  to  inspection  for  their  entire  length.  Cable  runs 
located  in  aeroelastlc  structure,  such  as  aircraft  wings,  shall  be  routed 
so  as  to  minimise  any  induced  control  action,  caused  by  structural  flexure. 
Spacing  between  adjacent  cables  shall  prevent  cables,  turnbuckles,  and  fit- 
tings from  chafing  during  all  operating  conditions  including  vibration. 

Slack  return  cables  shall  not  snag  on  each  other  or  any  other  equipment  or 
structure  when  the  controlling  cables  are  loaded  to  design  limit  loads  at 
the  adverse  extremes  of  temperature,  structural  deflection,  and  other 
operating  conditions.  Cables  shall  not  be  subjected  to  critical  bends  at 
the  junction  with  cable  terminals  or  other  attaching  points  such  as  on 
drums  and  s<^ctors. 

DISCUSSION 

A minimum  number  of  pulleys  and  brackets  is  highly  desirable,  and  con- 
sideration should  be  given  to  their  simplification.  Unsupported  spans  of 
150  to  200  Inches  have  operated  very  satisfactorily;  however,  idler  pulleys 
should  be  used  in  long  straight  runs  to  minimize  friction  over  fairleads  and 
grommets  with  normal  structural  deflections.  Simple  brackets  may  usually  be 
designed  if  the  cable  runs  are  kept  parallel  to  at  least  one  axis  of  the 
airplane  or  parallel  to  the  supporting  surface.  A fan  type  cable  run 
usually  results  in  complicated  and/or  inaccessible  brackets. 

The  main  flight  control  cables  in  the  wing  should  be  run  along  the  wing 
neutral  axis,  and  all  other  cables  should  be  as  .^ear  to  the  neutral  axis  as 
possible.  Runs  from  any  one  control  element  should  be  located  on  the  same 
side  and  at  the  same  distance  from  the  neutral  axis  to  eliminate  any  induced 
control  action  caused  by  wing  flexure.  To  maintain  rigging  and  control 
clearances,  Idlers  should  be  used  to  restrict  cable  movement  away  from  the 
wing  neutral  axis. 

It  is  not  desirable  to  route  control  cable  around  movable  equipment  and 
hatches.  Each  new  aircraft  model  should  be  thoroughly  Inspected  to  determine 
that  all  removable  or  hinged  covers  on  equipment,  or  rotating  or  swinging 
Items  of  equipment,  do  not  interfere  with  or  rub  on  the  control  cables. 

When  using  the  minimum  local  spacings  allowed  per  3.2. 3.1.2,  the  cables 
should  be  supported  more  frequently  than  normal  and  turnbuckles  placed  where 
more  clearance  is  available.  The  effect  of  return  cable  slack  caused  by  the 
application  of  design  loads  on  the  controlling  side,  and  due  to  temperature 
and  other  effects,  must  be  carefully  considered.  The  adequacy  of  guards, 
fairleads,  and  rub  strips  should  be  confirmed  during  proof  and  operational 
tests  on  a production  aircraft.  Reconfirmation  should  be  done  at  each  major 
revision  or  model  change. 

3. 2. 3. 2. 4. 5 Cable  sheaves.  Cable  drums,  sectors,  and  pulleys  of  adequate 
capacity  and  diameter  for  their  function  and  to  meet  aircraft  life  require- 
ments shall  be  provided.  They  shall  be  large  enough  for  the  cable  wrap 
angle  such  that  the  cable  strands  are  not  overstressed.  The  diameter  and 
number  of  grooves  on  cable  drums,  and  the  radius  and  angle  of  control  cable 
sectors  shall  be  adequate  for  the  required  cable  travel.  Overtravel  allow- 
ance shall  not  be  less  than  5 percent  of  full  travel  in  either  direction  and 
at  least  10  degrees.  When  cable  wrap  varies  with  cable  travel,  the  initial 
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wrap  with  the  sheave  In  the  neutral  position  shall  be  at  least  115  percent 
of  the  full  cable  travel  in  either  direction.  If  over travel  exceeds  the 
minimum  required,  cable  wrap  shall  be  Increased  a corresponding  amount. 

All  cable  grooves  on  drums  and  sectors,  machined  or  die  cast,  shall  have 
root  radii  properly  sized  for  the  cable  size  used  thereon.  Specific 
approval  shall  be  obtained  before  using  plain  pulleys  in  essential  appli*- 
cations.  Antiirlction  pulleys  used  in  flight  control  systems  shall  be 
MS  standards  in  accordance  with  MIL-P-7034,  and  the  design  limit  load 
shall  not  exceed  the  allowable  limit  load  specified  for  the  applicable 
standard. 

DISCUSSION 

Tests  have  been  conducted  to  show  the  reduction  in  bending  life  as  the 
sheave  to  cable  ratio  is  reduced.  The  table  below  shows  the  approximate 
manner  in  which  relative  laboratory  bending  life  is  reduced  as  the  sheave  to 
rope  ratio  decreases. 

Sheave  to  Rope  Ratio  Relative  Laboratory  Bending  Life 


30 

100 

28 

86 

26 

72 

24 

59 

22 

48 

20 

38 

18 

29 

16 

21 

14 

15 

12 

11 

10 

8 

8 

6 

6 

4 

Source:  Roebling  Wire  Rope  Handbook,  1966,  Page  57. 

This  table  was  developed  by  running  actual  tests  on  cable.  It  shows 
that  by  reducing  the  sheave  diameter  by  one  half,  relative  cable  life  is 
reduced  by  70  to  80  percent. 

There  are  different  formulas  for  calculating  bending  stresses  in  the 
wires  of  cable  when  it  is  bent  around  a sheave  during  operation.  Using  the 
formula: 


f=  .67£i 
D 


f = Bending  stress  - psi 
E = Modulus  of  elasticity  of  wire  - psi 

d = Diameter  of  outside  wire  - inches 

D = Pulley  root  diameter  - inches 


the  bending  stress  can  be  calculated.  This  formula  is  a median  of  eight 
different  one's  advanced  for  the  solution  of  the  problem.  The  stress  produced 
by  bending  can  be  compared  to  the  stress  produced  by  a straight  tensile  load. 
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The  following  comparisons  for  the  MS  pulleys  for  1/8  through  3/16  Inch 
aircraft  cable  demonstrate  how  the  smaller  pulleys  greatly  reduce  cable  life 
and  Increase  bending  stress. 


CABLE 

PULLEY 

ROOT 

DIAM. 

(IN.) 

1/8”  7x19 

MS20220-1 

1.255 

1/8”  7x19 

-2 

2.505 

1/8”  7x19 

-3 

3.755 

1/8”  7x19 

4 

5.C05 

5/32”  7x19 

MS20220-1 

1.255 

5/32”  7x19 

•2 

2.505 

5/32”  7x19 

-3 

3.755 

5/32”  7x19 

4 

5.005 

3/16”  7x19 

MS20220-1 

1.255 

3/16”  7x19 

-2 

2.505 

3/16”  7x19 

■3 

3.755 

3/16”  7x19 

4 

5.005 

SHEAVE 

TO 

BENDING 

EQUIV. 

TENSILE 

CABLE 

STRESS 

LOAD 

RELATIVE 

RATIO 

(psi) 

(LB) 

LIFE 

10 

128,600 

1055 

8 

20 

64,400 

528 

38 

30 

43,000 

352 

100 

40 

32,200 

264 

- 

7.;' 

158,400 

1965 

5 

15 

79.300 

983 

18 

22.5 

53,000 

657 

51 

30 

39,700 

492 

100 

6.5 

188,500 

3280 

4 

13 

94,500 

1645 

13 

22.5 

63,000 

1100 

33 

25 

47,200 

820 

65 

This  comparison  shows  the  importance  of  using  the  largest  turn  radius 
possible.  Although  the  bending  stress  formula  used  shows  only  a linear 
relationship  to  the  root  diameter,  the  relative  life  from  the  first  table 
shows  how  much  the  higher  stress  reduces  cable  life. 

Because  of  the  many  other  factors  involved,  it  is  impossible  to  estab- 
lish firm  criteria  for  the  proper  cable-pulley  ratio.  Final  determination 
has  to  be  based  on  expected  load,  safety  factor  desired,  and  required  life. 
Adequate  testing  should  be  conducted  prior  to  final  sheave  design  and  pulley 
selection. 

The  importance  of  groove  radius  is  demonstrated  by  the  results  of  tests 
run  on  3/16  in, 7 x 19  preformed  stainless  steel  cable,  summarized  in  Fig- 
ure 13D.  In  each  case,  the  cable  was  deflected  90  degrees  around  the  sheave 
under  a load  of  800  pounds  with  oscillations  of  1 inch  amplitude.  For  each 
of  the  three  pulley  sizes,  the  best  cable  life  resulted  with  a groove  radius 
of  one-half  the  cable  diameter.  This  allows  for  maximum  support  of  the  cable 
by  the  pulley  and  prevents  the  cable  from  flattening  or  becoming  distorted. 
Care  must  be  taken,  however,  to  allow  adequate  clearance  for  the  cable  in 
order  to  prevent  wedging  and  allow  the  cable  to  rotate  freely.  One  formula 
used  successfully  for  a great  number  of  applications  is: 
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3/8"  GROOVE  RADIUS 


C/2  X 1.15  where; 


Rr  = 


- root  or  bottom  radius 
C = cable  diameter. 


Antifriction  pulleys  are  required  to  keep  cable  system  friction  within 
acceptable  limits.  However,  careful  attention  to  the  nuonber  of  pulleys, 
wrap  angles,  and  rigging  load  is  required,  especially  if  friction  is  criti- 
cal. In  long,  straight  runs,  however,  idler  pulleys  should  be  used  to 
minimize  friction  over  fairleads  and  grommets  with  normal  structural  deflec- 
tions. 

The  approved  antifriction  pulleys  in  accordance  with  MIL-P-7034  are  con- 
trolled by  the  following  standards: 

MS20.219,  Pulley,  Groove,  Secondary  Control,  Aircraft 
MS20220,  Pulley,  Groove,  Flight  Control,  Aircraft 
MS202.21,  Pulley,  Groove,  Heavy  Duty,  Control,  Aircraft 
MS2A566,  Pulley-Control,  Antifriction  Bearing 

Their  allowable  loads  are  listed  on  the  standard  drawings,  and  are  sum- 
marized in  one  table  in  AFSC  Design  Handbook  DH  2-1,  DN  3B1,  Subnote  1.1. 2(1), 
"Standard  Pulleys." 

It  should  be  noted  that  these  pulleys  are  sized  in  increments  for  use 
with  either  two  or  three  cable  sizes.  Therefore,  only  the  largest  cables  in 
each  size  range  will  have  an  optimum  fit  in  the  groove.  Thli  is  a compromise 
to  keep  the  number  of  sizes  which  must  be  stocked  within  a reasonable  limit, 
but  does  compromise  optimum  life  and  friction  somewhat.  The  flattening  of 
the  cable  in  an  oversized  groove  not  only  reduces  life  as  shown  in  Figure  13D, 
hut  also  increases  friction. 

3. 2. 3. 2. 4. 6 Cable  and  pulley  alignment.  Fixed-mounted  pulleys  shall  be 
aligned  with  their  cables  within  2 degrees  as  specified  in  AFSC  Design  Hand- 
book DH  2-1,  DN  3B1,  Subnote  1.1. 3(1),  Cable  Pull.  Where  a control  cable 
has  an  angular  motion  with  respect  to  the  plane  of  the  pulleys,  the  maximum 
misalignment  resulting  from  this  motion  must  not  exceed  2 degrees,  and  the 
cable  shall  not  contact  the  pulley  (or  quadrant)  flange  for  the  total  cable 
travel. 

DISCUSSION 

Accurate  alignment  is  required  to  prevent  cables  from  coming  out  of  their 
pulleys.  A design  misalignment  limit  of  0.5  degrees  is  usually  used  to  ensure 
the  2-degree  limit  on  the  manufactured  product.  Pulleys  should  be  mounted  in 
vertical  planes;  however,  in  some  situations,  it  may  be  necessary  to  use  cable 
guide  tubes  or  closely  mounted  fairleads  to  limit  misalignment  due  to  catenary 
affect  or  slackening  of  the  cable. 
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3. 2. 3. 2. 4. 7 Pulley-bracket  apaccrs.  Loose  spacers  between  pulleys,  bearings, 
and  pulley  brackets  shall  not  be  used. 

DISCUSSION 

Spotwelded,  riveted,  or  other  fixed  spacers,  flanged  bushings,  or  dimpled 
brackets  should  be  used  In  lieu  of  loose  spacers. 

3.2. 3. 2. 4. 8 Sheave  guards.  Guards  shall  be  Installed  at  all  sheaves  (pulleys, 
sectors,  drums,  etc.)  as  necessary  to  prevent  the  cable  from  Jumping  out  of  the 
groove  of  the  sheave.  Guards  shall  be  Installed  at  the  approximate  point  of 
tangency  of  the  cable  to  the  sheave.  Where  the  cable  wrap  exceeds  90  degrees, 
one  or  more  Intermediate  guards  shall  be  Installed.  All  guards  shall  be  sup- 
ported In  a way  which  precludes  binding  of  the  sheave  due  to  relative  deflec- 
tions In  the  aircraft  structure.  Additional  guards  shall  be  Installed  on 
sectors  as  necessary  to  ensure  retention  of  the  cable  end  In  Its  attachment 
under  slack  cable  conditions.  The  design  of  the  rubbing  edges  of  the  guard 
and  the  selection  of  materials  shall  be  such  as  to  minimize  cable  wear  and 
prevent  Jamming  even  when  the  cable  Is  slack. 

DISCUSSION 

The  number  of  guards  required  varies  with  the  angle  of  cable  wrap  and 
cable  flexibility.  Cable  Installation  and  replacement  requirements  will 
usually  determine  the  type  of  guards  best  for  each  sheave.  In  complex 
bracket  assemblies,  removable  guards  (pins,  bolts,  and  spacers)  are  usually 
preferred.  In  simple  brackets,  fixed  guards  (rivets  and  spacers)  may  be 
considered  provided  the  pulley  may  be  easily  removed . 

3. 2. 3. 2. 4. 9 Sheave  spacing.  In  any  given  cable  run,  no  portion  of  the  cable 
shall  ever  pass  over  more  than  one  sheave. 

DISCUSSION 

This  is  to  reduce  wear  and  friction.  Cable  tends  to  twist  over  each 
pulley.  If  the  twist  from  one  pulley  rides  on  to  another  pulley,  it  will 
cause  Increased  wear  and  friction. 

3.2.3.2.4.10  Cable  tension.  Cable  rig  loads  shall  insure  positive  cable 
tension  in  control  and  return  legs  o^  closed-loop  cable  Installations  under 
all  operating  conditions  including  airframe  deflection  and  differential 
expansion  and  contraction  between  the  cable  and  airframe  structure  through- 
out the  designed  operating  temperature  range.  The  cable  return  leg  may  be 
allowed  to  go  slack  when  the  control  leg  is  loaded  above  the  normal  operating 
load,  providing  it  cannot  snag,  when  the  control  leg  is  loaded  at  any  load  up 
to  limit  load,  and  that  there  Is  no  hazardous  loss  of  system  performance. 

Cable  tension  regulators  shall  be  provided  only  if  positive  cable  tension 
cannot  be  maintained  In  both  legs,  with  reasonable  rigging  loads. 

DISCUSSION 

Closed  cable  installations  should  never  go  slack  under  normal  operating 
loads,  or  system  deadband  and  loss  of  response  will  occur.  Limit  loads  are 
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normally  developed  only  under  adverse  conditiona  such  as  sticking  or  Jammed 
control  valves  or  llnkageSi  however;  and,  it  Is  usually  permissible  for  the 
return  leg  to  go  slack  under  such  occurrences. 


Closed  cable  installations  are  rigged  to  a predetermined  load  in  order 
to  decrease  the  deflection  between  the  location  of  the  Input  force  and  the 
location  of  the  output  force.  The  rigging  load  trust  be  greater  than  half 
the  maxlirum  normal  operating  load  so  that  the  return  leg  does  not  go  slack 
under  the  range  of  normal  operating  load. 

With  a rigging  load  equal  to  half  the  maximum  normal  operation  load, 
the  cable  deflection  throughout  the  normal  operating  load  range  will  be 
approximately  half  the  deflection  of  cable  without  rigging  load.  See 
Figure  14D.  Increasing  the  rigging  load  reduces  deflection  further,  but 
increases  friction  and  may  overload  pulleys. 

Because  of  differing  coefficients  of  thermal  expansion  between  the 
cable  and  the  airframe,  cable  loads  can  vary  through  a wide  range  due  to 
temperature  changes.  As  ambient  temperature  increases,  rigging  loads  of 
closed  systems  can  Increase  to  the  point  where  friction  has  a detrimental 
effect  on  resolution  and  stability  of  the  system.  As  ambient  temperature 
decreases,  the  rigging  load  could  be  so  low,  or  lost  completely,  that  a 
"spongy"  or  Inaccurate  response  of  the  control  surfaces  will  result. 

Cable  tension  regulators  are  often  Installed  in  quadrant  assemblies  of 
a control  installation  to  take  up  the  slack  or  allow  for  contraction  of  the 
cables  without  appreciable  variation  of  the  rigging  load  during  temperature 
changes  throughout  the  design  range. 


Without  Rigging  Load 
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Figure  14D,  Rigging  Load  and  Operating  Deflection 
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3.2. 3. 2. A. 11  Cable  fnalon  regulatora.  When  uicd»  tension  regulators  shall 
maintain  required  tension  at  all  times.  Integral  calibration  shall  be  pro- 
vided  to  show  proper  cable  tension  without  the  use  of  external  tensionmeters 
or  other  equipment. 

DISCUSSION 

The  advantages  of  tension  regulators  should  be  carefully  weighed  against 
the  disadvsntages  of  additional  weight,  complexity,  cost,  and  the  possibility 
that  a failure  may  Introduce  dangerous  control  transients  or  cause  the  cable 
to  go  completely  slack.  A better  approach  is  often  to  design  a "soft"  system 
with  cables  small  enough  to  stretch  to  allow  for  temperature  changes  but  still 
tight  enough  for  operation  at  minimum  designed  temperature. 

3.2.3.2.4.12  Fair leads  and  rubbing  strips.  Felrleads  shall  not  cause  any 
angular  change  greater  than  3 degrees  in  the  direction  of  the  cable  under  all 
conditions  Including  those  due  to  structural  deflections  in  flight.  Fair- 
leads  shall  be  split  to  permit  easy  removal  unless  the  size  of  the  hole  is 
sufficient  to  permit  the  cable  with  swage  terminals  to  be  threaded  through. 

DISCUSSION 

Fairleads  and  rubbing  strips  may  be  needed  to  keep  cables  from  chafing, 
snagging,  and  slapping  against  each  other  and  adjacent  parts  of  the  aircraft 
The  necessity  for  fairleads  can  be  reduced  by  keeping  cable  runs  away  from 
structure  as  much  as  possible.  Rub  strips  may  often  be  Installed  if  there 
is  a possibility  of  the  cable  hitting  structure  or  equipment. 

Where  space  permits,  the  fairleads  should  clear  the  primary  flight 
control  cables  by  a minimum  of  1/4  inch.  The  cables  may  rest  against  the 
lower  edge  of  the  hole  in  fairleads  on  long,  straight  cable  runs  where  the 
cables  would  normally  sag  due  to  their  own  weight  even  though  properly 
rigged. 


Grommet  Type  Fairleads 

A grommet  type  falrlead  should  be  used  where  cable  passes  through 
structure  unless  a pressure  seal  is  required.  The  falrlead  holes  should  be 
as  large  as  possible  and  a tight  falrlead  should  not  be  used  unless  abso- 
lutely necessary.  If  a tight  falrlead  is  required,  the  installation  must  be 
adjustable  to  correct  for  shop  errors.  Holes  in  a tight  falrlead  should  be 
approximately  .05  larger  than  the  nominal  cable  diameter. 

Wing  Fairleads 

Wing  fairleads  should  be  slotted  to  allow  the  cable  to  rise  and 
fall  with  the  wing  deflected  under  1/2  the  design  load  factor.  If  this  is 
not  practicable,  falrlead  pulleys  should  be  used. 

3.2.3.2.4.13  Pressure  seals.  Pressure  seals  shall  meet  compartment  seal- 
ing requirements  within  cable  installation  friction  requirements.  They  shall 
be  designed  to  preclude  jamming  the  control  system. 
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DISCUSSION 


Types  which  htfve  been  eucceeefully  used  In  many  applicationa  include; 

The  Finned~Type  shewn  following  which  has  been  used  to  seal 
pressurized  compartments  in  many  applications  where  minimum  friction  is 
required.  They  may  be  installed  or  replaced  after  cables  are  rigged,  but 
must  be  installed  with  the  small  end  to  the  high  pressure  side  of  the 
bulkhead,  as  they  will  not  seal  if  reversed. 


The  Eyeball-Type  shown  below  which  hts  an  angular  self-aligning 
feature  which  ^an  reduce  wear  and  subsequent  leakage  in  cable  installations 
subject  to  misalignment. 
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3.2. 3.2.5  Push’-'pull  rod  Installations.  Push'-pull  rod  Installations  shall 
be  designed  to  preclude  binding  or  separating  from  the  mating  linkage,  and 
shall  permit  servicing  and  rigging. 

DISCUSSION 

Push-pull  rod  installations  are  often  determined  to  be  more  suitable 
than  control  cables  or  other  signal  transmission  means,  either  as  a total 
concept  or  for  selected  locations  within  a control  cable  installation. 
Push-pull  rod  Inotallatlona  Include  the  rod  assemblies,  with  fixed  and/or 
adjustable  terminals,  levers,  and  bellcranks,  and  guides  or  other  supports 
as  necessary  to  prevent  fouling. 

3.2. 3. 2. 5.1  Push-pull  rod  aasemblies.  Push-pull  rod  assemblies  shall  be 
designed  and  installed  such  that  inadvertent  detachment  of  adjustable  term- 
inals is  Impossible,  and  such  that  any  change  in  length  due  to  loosening  of 
the  terminals  cannot  result  in  an  unsafe  condition.  On  any  single  rod 
assembly,  adjustment  shall  be  possible  at  one  end  only.  The  fixed  end  of 
each  rod  shall  be  attached  to  its  mating  linkage  element  in  a manner  which 
precludes  rotation  of  the  Installed  assembly.  The  adjustable  end  shall  be 
of  the  clevis  type  or  join  a clevis  type  in  such  a manner  that  it  is  also 
prevented  from  rotating.  When  an  unsymmetrical  rod  is  used,  such  as  one 
with  a cutaway  portion  to  allow  for  relative  motion  of  an  attached  link, 
the  rod  end  terminals  and  mating  linkage  elements  shall  positively  prevent 
Incorrect  installation  of  the  rod.  Push-pull  rods  shall  have  a minimum  wall 
thickness  of  0.035  inches  and  shall  be  capable  of  withstandir.g  loads  of  1.5 
times  limit  loads  in  both  tension  and  compression  without  failure,  buckling, 
or  any  other  form  of  permanent  deformation.  All  joints  shall  be  made  in  a 
manner  which  precludes  loosening  and  fatigue  failure.  All  closed  cavities 
in  rod  assemblies  Installed  in  unpressurized  spaces  shall  be  provided  with 
drain  holes  adequate  to  drain  ingested  water  unless  cavities  are  air  tight. 
All  push-pull  rod  terminals  shall  incorporate  antifriction  bearings  per 

3.2. 7. 2. 1.1  or  self-lubricating  spherical  bearings  as  specified  in 

3. 2. 7. 2. 1.2.  All  terminal  pins  shall  be  retained  as  specified  in 

3. 2. 8. 3. 2. 2.  Loose  washers  or  other  loose  spacers  shall  not  be  used  to 
maintain  terminal  spacing  in  the  connecting  linkage. 

DISCUSSION 

Rotation  of  a single-adjustable-end  rod  can  be  prevented  by  mating  a 
fixed  clevis  terminal  on  the  rod  with  a nonadjustable  linkage  lug  end,  or 
conversely  by  mating  a fixed  lug  end  on  the  rod  with  a nonadjustable  clevis 
on  the  linkage  element. 

Rods  requiring  adjustment  at  both  ends  are  not  rermitted.  If  fine 
adjustments  of  rod  length  are  necessary,  it  may  be  allowed  through  deviation 
providing  the  nonseparation  and  adverse-length  requirements  are  met.  A turn- 
buckle  approach,  i.e.,  with  right-hand  threaded  terminals  on  one  end  and 
left-hand  threaded  terminals  on  tlie  other,  snould  not  be  used.  If  very  fine 
adjustment  is  needed,  terminals  with  differing  thread  pitch  (one  end  finer 
than  the  other)  can  be  used.  Where  dual-end  adjustment  is  authorized,  the 
rod  should  be  designed  so  that,  if  the  terminal  connections  inadvertently 
loosen,  either  end  will  bottom  on  the  rod  prior  to  the  terminal  at  the 
opposite  end  becoming  detached. 
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Push-pull  rods  should  not  be  used  to  carry  heavy  compressive  loads;  but 
where  both  compression  and  tension  loads  exist,  the  heaviest  load  should 
put  the  red  in  tension.  The  0.035’-inch  minimum  wall  requirement  is  an 
arbitrary  limit  which  has  been  deemed  necessary  to  prevent  failures  due  to 
handling  and  other  maintenance  even  though,  in  some  cases,  strength  require- 
merits  will  be  exceeded. 

Drain  ho  es  are  required  in  all  hollow  rods  with  loose  fitting  ends  or 
with  ends  i reached  with  a threaded  joint  which  will  allow  moisture  to  enter 
the  rod  cavity  directly  or  entrained  in  vapors  VJhich  can  subsequently  con- 
dense. In  addition  to  the  possibilities  of  corrosion,  and  the  addition  of 
weight  to  the  rod  (which  might  even  inti'oduce  unwanted  control  moments  in 
the  linkage),  rod  failures  have  occurred  due  to  expansion  of  the  water  upon 
freezing.  Welded  joints  a 1 ends  riveted  after  assembly  with  wet  epoxy 
primer  are  generally  considered  sufficiently  air  tight.  Where  drain  holes 
are  used,  they  must  be  large  enough  to  drain  collected  moisture  before  the 
freezeover,  and  not  so  large  that  they  unduly  weaken  the  rod. 

Hollow  nonadjuetable  rod  ends  should  not  be  attached  with  rivets  or 
other  fasteners  in  a manner  where  they  are  subject  to  bending  and  fatigue 
failure.  See  AFSC  Design  Handbook  DH  2-1,  DN  3B1,  Subnote  2.2(2),  "Example 
of  Why  Shear  Bolts  Are  Preferred  When  Installing  Rod  Ends."  An  alternate  is 
to  use  a riveted  joint  with  a plastic  or  phenolic  filler  plug  in  the  hollow 
rod  end. 

Regarding  lateral  spacing  of  the  terminal  in  its  connecting  linkage,  see 
AFSC  Design  Handbook  DH  2-1,  DN  3B1  Subnote  2.2(1),  "Benefit  of  Bushings  for 
Rod  End  Installation."  The  use  of  bushings  will  prevent  loose  joints  due  to 
neglect  to  install  loose  spacers,  and  will  be  helpful  in  preventing  stress 
failures  in  the  clevis  end. 

3. 2. 3. 2. 5. 2  Levers  and  bellcranks.  Applicable  requirements  in  AFSC  Design 
Handbook  DH  1-6;  System  Safety,  Section  3J ; Flight  Control  Systems,  Design 
Note  3J2;  Mechanical  Flight  Controls;  Pulleys,  Brackets  and  Bellcranks, 
and  Design  Note  3JX;  Safety  Design  Check  list,  shall  be  met.  Bearings  shall 
have  adequate  self-aligning  capability  if  necessary  to  prevent  excessive 
deflection  loads  on  levers  and  bellcranks,  and,  their  installations  shall  be 
designed  for  easy  replacement  so  that  the  parent  part  may  be  reused.  Levers 
and  bellcranks  designed  with  dual  load  paths  having  the  two  sections  posi- 
tively joined  by  permanent  fasteners,  such  as  rivets,  shall  be  bonded  with 
adhesive. 


3. 2. 3. 2. 5. 3  Push-pull  rod  supports.  Where  lo.  g sections  of  push-pull  rods 
are  utilized  in  applications  where  jamming  is  not  extremely  remote,  guides 
shall  be  installed  at  intervals  to  preclude  fouling  in  the  event  of  rod 
failure . 


3. 2. 3. 2. 5. 4  Push-pull  rod  clearance.  Clearance  between  push-pull  rods,  and 
between  rods  and  aircraft  equipment  and  structure,  shall  be  as  specified  in 
3.2. 3.1.?  except  that  it  shall  also  be  sufficient  to  permit  removal  of 
adjacent  LRU's  without  disconnecting  the  rods. 


3.2. 3.2.6  Control  chain.  Wliere  used,  control  chains  shall  be  of  standard 
aircraft  quality  and  conform  to  MIL-3TD-421 . Connecting  links  shall  be 
retained  with  standard  nonhardened  cotter  pins.  Spring  clips  shall  not  be 
used. 

DISCUSSION 

In  many  ca‘'c;s,  where  rotational  signals  which  must  make  a multiplicity 
of  turnc  and  be  transmitted  to  another  shaft  located  too  remotely  for  con- 
nection through  gearing,  chain  drives  will  prove  to  be  the  best  solution. 

The  requirement  to  bond  joined  sections  of  dual  load  path  levers  and 
bellcranks  with  adhesive  is  meant  to  prevent  entrance  of  moisture  between 
the  fayed  surfaces,  and  jamming  due  to  separation  of  loose  pieces. 

3. 2. 3. 2. 7 Push-pull  flexible  controls.  Push-pull  flexible  controls  may  be 
used  for  transmitting  control  signals  in  noncritical  applications,  but  spec- 
ific approval  from  the  procuring  activity  must  be  obtained  before  use  in 
esse,  -ial  and  flight  phase  essential  applications.  Where  used,  they  shall 
conform  to  MIL-C-7958.  Installations  shall  avoid  an  excessive  number  of 
bends  to  keep  friction  forces  within  acceptable  values  and  minimize  the 
possibility  of  jamming,  and  the  routing  shall  preclude  damage  due  to  per- 
sonnel using  them  as  steps  and  handholds.  Conduits  shall  be  supported  at 
frequent  intervals,  but  not  so  tightly  that  the  control  is  rest;rained 
axially. 

DISCUSSION 

The  requirement  that  specific  approval  must  be  obtained  before  use  of 
flexible  controls  in  essential  and  flight  phase  essential  applicatioi’s  i.s  nor 
intended  to  prohibit  their  use,  but  rather  to  ensure  that  the  contractor  ha.s 
fully  investigated  their  capability  to  perform  satisfactorily  in  the  intended 
application  and  exercises  proper  care  in  the  installation  design. 

Sliding-friction  flexible  controls  were  the  fir.st  type  used,  and  NIL- 
C-7958  is  oriented  to  that  type.  However,  because  of  their  higher  efficiency, 
the  ball-bearing  type  has  come  into  use  for  a number  of  recent  applications. 
These  include  engine  controls,  wing  sweep  and  flap  controls,  and  wheel  brake 
and  landing  gear  controls  on  tlie  K-111  and  rudder  control  on  the  K-jh. 

Installation  of  the  bail-bearing  type  generally  requires  more  care  than 
for  sliding  friction  controls.  With  the  latter,  care  must  be  taken  in  the 
installation  design  to  limit  the  number  of  bends  so  that  friction  forces  do 
not  become  excessive;  and,  in  tlie  actual  installation,  they  mu.st  not  be 
forced  into  other  than  a natural  curve.  The  be I.l -bearing  types  are  more 
sensitive  to  installation  error.  All  bends  muse  be  kept  in  a single  plane  or 
the  control  helixed  into  other  bend  planes  at  a controlled  rate  (within  a 
limited  rotational  arc  per  unit  length)  to  prevent  binding  or  damage.  Tliey 
must  also  be  supported  at  frequent  intervals,  but  not  so  tightly  that  tlie 
conduit  is  restrained  axially  or  pinched  where  motion  of  the  internal  compon- 
ents may  be  impaired.  Routing  should  preclude  personnel  using  them  as  steps 
and  handholds  per  3. 2. 3. 1.1. 
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3. 2. 3. 3 Electrical  signal  transmission.  The  following  requirements  apply 
to  all  essential  and  flight  phase  essential  signal  paths.  Except  for  power 
sources,  such  systems  shall  be  Independent  of  failure  inodes  associated  with 
any  other  electrical  system.  Cross  connections  between  redundant  electrical 
signal  paths  shall  be  eliminated,  or  minimized  and  electrically  Isolated. 
Wire  runs  and  components  in  redundant  control  paths  shall  be  physically 
separated  and  electrical  shielding  shall  be  Installed,  as  necessary,  to  meet 
failure  Immunity  and  invulnerability  requirements.  All  interconnecting  wir- 
ing shall  be  prefabricated,  jacketed  cable  assemblies.  The  outer  jackets 
shall  be  identifiable  by  a unique  color  or  other  means.  Wiring  installation 
shall  be  in  accordance  with  MIL-W-5088. 

DISCUSSION 

Requirements  for  electrical  power  sources  are  discussed  in  detail  in 
3. 2. 5. 4.  Failure  immunity  requirements  which  permit  loss  of  only  one  redun- 
dant channel  due  to  any  single  failure,  not  extremely  remote,  are  discussed 
in  3.1.3.  Identifying  each  channel  supplying  essential  and  flight  phase 
essential  systems  will  serve  to  prevent  damage  from  careless  maintenance. 

Wiring  associated  with  redundant  systems  must  be  adequately  separated 
and/or  protected  from  hazards  such  as: 

Wire  bundle  fire 

Equipment  or  junction  box  fire 

Connector  shorting  or  decoupling 

Fuel  Fire 

Engine  case  burn  through 

Turbine  burst  fragments  (including  turbofans  and  starter  turbines) 

Battery  chemical  leakage 

Abrasion  from  rocks,  ice,  and  mud 

Burst  hot  air  ducting 

Lightning  currents  from  plausible  failures  of  lightning  protection 

Various  systems  of  bundle  routing,  raceway  selection  or  wire  protection 
may  be  developed.  For  circuits  which  are  to  be  separated  from  one  another 
for  reasons  other  than  EMI,  adequate  separation  can  normally  be  achieved  by: 

Physical  separation  by  either  routing  in  separate  bundles  or 
raceways,  by  maintaining  a safe  clearance  from  other  wires,  or  by  enclosing 
the  critical  wire  in  suitable  sleeving  or  tape. 

Never  routing  through  the  same  connector. 

Not  routing  through  the  same  junction  box. 
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Not  routing  through  areas  where  excessive  envlronnmental  conditions 
or  mechanical  failures  can  adversely  affect  any  redundant  system  wiring, 
e.g.,  turbine  burst  envelopes,  hot  air  from  a burst  pneumatic  duct,  etc. 

Within  the  APCS,  a critical  wire  may  be  defined  as  any  wire  which,  when 
grounded,  opened,  shorted  to  an  energized  power  source  or  an  adjacent  signal- 
carrying  wire  will  induce  one  of  the  following: 

Bypass  a monitoring  function. 

Create  a simultaneous  fault  in  any  two  identical  control  channels 
or  any  two  identical  sensors. 

'Cause  any  two  identical  control  channels  to  receive  a single- 
source input  signal. 

Inhibit  the  commanded  disengagement  of  a control  channel  or  its 
hydraulic  servo  package. 

In  fail-operational  autopilot  packaging  particular  care  must  be  exer- 
cised to  ensure  that  system  isolation  is  not  jeopardized  at  the  mode  select 
panel,  the  automatic  test  unit,  and  the  accessory  boxes.  In  these  areas, 
cables  should  be  routed  with  suitable  physical  separation  or  shield  protec- 
tion to  separate  connectors.  In  addition,  automatic  control  and  flight 
director  signals  should  be  isolated  from  each  other  such  that  failure  in  one, 
downstream  of  the  last  conm.on  tie,  does  not  have  an  adverse  effect  upon  the 
other. 


3.2. 3. 3.1  Electrical  flight  control  (EFC)  interconnections.  EFC(6.6)  wiring 
in  individual  channels  shall  be  routed,  isolated  and  protected  to  minimize 
the  applicable  threats  to  redundancy.  Channel  loss  due  to  any  foreseeable 
hazard,  not  extremely  remote,  shall  be  limited  to  a maximum  of  a single  chan- 
nel. The  adequacy  of  the  separation,  isolation  and  protection  attainable  in 
any  given  location  for  any  given  hazard  shall  be  evaluated  for  each  aircraft 
design.  Additional  protection  shall  be  provided  for  the  EFC  wiring  where 
analysis  shows  that  any  single  hazardous  event,  not  extremely  remote,  could 
cause  the  loss  of  more  than  one  EFC  channel.  Primary  structural  components 
shall  be  used  to  afford  this  protection  where  possible.  Where  it  is  approved 
by  the  procuring  activity  to  route  the  EFC  wiring  through  wheel  wells  or  other 
areas  subjected,  during  flight,  to  the  slipstream  or  impingement  of  runway 
fluids,  gravel,  etc.,  the  wiring  shall  be  protected  by  enclosures  and  routed 
directly  through  without  unnecessary  termination  or  junctions.  Where  termina- 
tions or  junctions  to  equipment  in  these  areas  are  required,  they  shall  be 
protected  from  such  impingements.  This  shall  also  be  done  in  areas  where  a 
high  level  of  maintenance  is  likely  to  be  required  on  other  systems  and 
equipment . 

DISCUSSION 

These  requirements  are  based  on  the  Reference  76  handbook  which  was 
generated  under  an  AFFDL  contract.  The  handbook  recommendations  were  based 
on  Apollo  techniques  and  hardware,  proposed  technical  and  hardware  for  the 
American  SST  and  on  information  from  the  Air  Force  Survivable  Flight  Control 
System  Program. 
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These  channel  separation  and  routing  requirements  are  In  addition  to  the 
overall  reliability  and  vulnerability  requirements  stated  In  3.1.7  and  3.1.9, 
and  amplify  the  failure  Immunity  requirements  of  3.1.3.  The  general  relia- 
bility and  vulnerability  requirements  may  lead  to  even  more  stringent  Inter- 
connection requirements  than  the  minimum  requirements  stated  here. 

Hazards  which  should  be  considered  as  foreseeable  hazarus  in  most  appli- 
cations Include: 

Combat  damage 

Localized  fire 

Turbine  burst 

Tire  burst 

Collision 

EMI 

Lightning 

Static  electricity 
Chemical  Damage 

Isolation  is  needed  to  assure  that  no  single  failure (s),  not  extreme] y 
remote,  of  other  systems  (including  wiring  failures  in  other  systems)  do  not 
cause  failures  In  the  EEC  wiring.  Isolation  may  also  be  needed  to  minimize 
electromagnetic  Interference  and  electromagnetic  pulse  pickup.  As  specified, 
each  situation  must  be  analyzed  and  where  attainable  isolation  ot  channel 
separation  is  inadequate,  protective  measures  must  be  taken, 

3. 2. 3. 3. 1.1  Cable  assembly  design  and  construction.  The  outer  jacketing  for 
EEC  wiring  shall  not  create  stresses  on  the  wire  and  connector  terminations 
and  shall  not  stress  the  wires  in  a manner  which  opens  the  connector  grommet 
seals.  During  design  of  the  cable  assemblies,  particular  attention  shall  be 
paid  to  the  requirements  of  the  circuits  within  the  cable  and  adequate  EMI 
and  EMP  control  methods,  e.g.,  shielding,  twisting,  etc.,  shall  be  incorpor- 
ated into  the  design.  Where  shielded  wires  are  used  provisions  shall  be 
made  for  carrying  the  shields  through  the  connectors  where  single  point 
grounding  is  necessary.  A signal  return  wire  shall  be  provided  for  each 
signal  level  circuit  in  the  cables.  All  cable  assemblies  shall  be  constructed 
in  an  area  with  temperature  and  humidity  controls  and  positive  pressure  venti- 
lation and  shall  be  cleaned  (all  wire  cuttings,  etc.,  removed)  and  inspected 
after  layup  and  prior  to  jacketing  to  assure  that  no  potentially  damaging 
particles  have  been  included,  particularly  at  the  entrance  to  the  grommet 
seal.  All  cable  assemblies  shall  be  constructed,  tested  and  inspected  by 
specially  trained  and  certified  personnel.  Terminal  boards  shall  not  be 
used  in  EEC  wiring.  Splices  shall  be  qualified,  permanent-type  splices. 
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3. 2. 3. 3. 1.2  Wire  termlnatioim . (a  i.itp  type  wut;  i eimi  u.i  i iun-s  (HjKule,  lug 

connector)  shall  be  used  on  all  liKC  tables.  Soldered  .iml  put.led  eouuec t Ions 
shall  not  be  used.  With  the  terminal  installed  on  the  wite,  the  v/1  re  shall 
be  visible  for  in' ' ectton  at  both  ends  of  the  ei  inii)  barrel.  The  le  ngth  oi 
wire  visible  be’  nt*  insulation  and  barrel  shall  n<>t  exteed  ,l/lb  incn. 

3. 2. 3. 3. 1.3  Inspection  and  rep]  icem^rl  . I'he  I'lC  udi  lny,  shall  ho  luslalU-h 
so  that  it  ..  i be  inspected  for  damage  and  replaced  as  necessary.  The  InstaJ 
lation  shall  provide  for  visual  inspection  In  critical  areas  .such  as  hazard- 
ous environment  areas  or  areas  where  a high  level  of  maintenance  is  required 
on  system  or  equipment  in  close  proximity. 

3. 2. 3. 3. 2 Mul ttplexing . Multiplexed  signal  transmission  circuits  shall  he 
the  digital  time-divlslon-multiplexlng  type  utilizing  a twisted  shielded 
pair  cable  as  the  transmission  media  for  the:  multiplex  bus.  The  multiplex 
data  bus  line  and  its  interface  electronics,  multiplex  terminal  unit  shall 
meet  MIL-STD-1553 . 

DISCUSSION 

MIL-STD-1553  deals  with  twisted  shielded  pair  multijilex  bus.  It  covci  s 
the  data  bus  characteristics,  the  Interface  between  the  data  and  the  remote 
terminal,  and  the  interface  between  the  principal  parts  of  the  remote  term- 
inal. The  interface  between  the  remote  terminal  and  the  subsystem  i.s  not 
part  of  the  standard. 

Reference  ‘/7  describes  trade  studies  supporting  the  selection  oi  a 
fly-by-wire  multiplexing  concept.  Arguments  for  selecting  the  preferred 
multiplex  concept  are  presented  and  several  potential  alternatives  are 
described.  Reference  78  describes  hencli  testing  of  the  breadboard  demon- 
strator developed.  Reference  79  describes  the  design,  qualification  test- 
ing and  flight  testing  of  fllglit-worthy  uml  t ipl  e-x  iug  lianiwaic  in  an  NC-l'ilil 
Inflight  Simulator  Airplane. 

Reference  80  answers  the  question:  "Wliy  Multiplex  Data  in  an  Aircraft 

Electrical  System?"  This  reference  predicts  equal  or  improved  performance 
in  the  following  areas  due  to  use  of  multiplexing  in  aircraft  systems: 

Weight 

Redundancy/ Rei iabil i ty 
Growth  and  Flexibility 
Maintainability 
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Cost 


3.2,4  SlRnal  computation. 

DISCUSSION 

With  the  Increased  use  of  computers  in  flight  control  systems,  a 
need  for  specification  requirements  has  developed.  General  design  require- 
ments pertaining  to  control  signal  computation  subsystems  have  been  compiled 
in  this  section.  Prior  to  procurement  of  the  flight  control  system  computa- 
tion equipment,  the  contractor  should  establish  the  type  of  computer  to  be 
used  for  each  flight  control  function  and  its  relationship  with  other  com- 
puters used  on  the  aircraft.  The  relative  figures  of  merit  of  analog  and 
digital  types,  central  versus  dedicated  or  federated  (semldedicated)  types, 
and  in  combining  functions  such  as  in  a multipurpose  air  data  computer,  or 
in  an  Integrated  automatic  guidance  and  control  system  should  be  established 
with  careful  attention  to  factors  such  as  mission  environment  and  the  various 
threats  and  hazards. 

3 . 2 . 4 . 1 General  requirements. 

3. 2. 4. 1.1  Transient  power  effects.  Flight  control  computers  shall  not 
suffer  adverse  effects,  which  result  in  operation  below  FCS  Operational 
State  I,  due  to  power  source  variations  within  the  limits  specified  for  the 
applicable  power  system.  In  the  event  of  power  source  interruption,  no 
adverse  effects  shall  result  which  limit  operation  or  performance  of  flight 
control  computers  upon  resumption  of  normal  quality  power. 

3.2.4. 1.2  Interchangeability . The  requirements  of  3. 2. 7. 1.2  shall  be  met, 
and  tolerances  shall  be  such  that  interchange  of  any  computer  component, 
module,  or  LRU  with  any  other  part  bearing  the  same  part  number  shall 
require  only  minimum  resetting  of  parameters  or  readjustment  of  other  com- 
ponents in  order  to  maintain  overall  tolerances. 

DISCUSSION 

The  designer  should  ensure  that  multiple  power  systems  per  3.2.5  as 
necessary  to  meet  the  reliability  and  invulnerability  requirements  specified 
in  3.1.7  and  3.1.9,  respectively,  are  provided.  It  should  be  noted  that 
mechanical  computation  means  as  specified  herein  include  those  means 
powered  mechanically  from  the  pilot  or  from  the  operation  of  or  feedback 
from  an  actuated  system  or  by  fluid  power  from  a hydraulic  or  pneumatic 
power  source. 

One  means  of  preventing  voltage  variations  from  changing  the  correla- 
tion between  commanded  and  actual  values  In  FCS  is  to  base  both  reference 
and  command  signals  on  the  same  voltage  source  as  the  corresponding  feed- 
back signal. 

3. 2. 4. 1.3  Computer  signals. 

3. 2. 4. 1.3.1  Signal  transmissions.  Signal  transmissions  between  computer 
components  and  modules  shall  be  done  by  using  direct  mechanical,  hydraulic, 
pneumatic,  or  electrical  connections,  as  required.  Use  of  light  transmis- 
sion technology  or  other  nonconvent ional  transmission  paths  requires 
specific  approval  of  the  procuring  activity. 


140 


3. 2. 4. 1.3. 2 Signal  path  protection.  Where  redundant  computing  paths  are 
provided  they  shall  be  Isolated  or  separated  when  required  to  meet  the 
Invulnerability  requirements  of  3.1.9. 

DISCUSSION 

The  use  of  fiber  optics  or  other  iy-ncon/tniMonal  signal  paths  may  be 
consldereJ  In  future  computation  equipment  r-nd,  the  requirement  that 
■^^^eclflf  approval  must  be  obtained  not  lir-cnded  to  prohibit  their  use 
but  rather  to  ensure  that  the  contractor  has  fully  Investigated  their  capa- 
bility to  perform  the  essential  functions  reliably  and  can  present  substan- 
tiating evidence  for  approval  before  committing  designs.  Environmental 
conditions,  loads,  and  life  cycle  requirements  should  be  consistently 
applied  to  all  computer  components  that  Interface.  In  addition,  separation 
must  be  provided  so  that  a failure  at  an  Interface  will  not  cause  the  loss 
of  more  than  one  computing  system.  Isolation  and  separation  of  redundant 
computing  paths  must  be  consistent  with  the  overall  redundancy  concept. 

3. 2. 4. 2 Mechanical  signal  computation. 

3. 2. 4. 2.1  Element  loads.  Mechanical  computer  signal  transmission  elements 
subjected  to  the  pilots'  Input  force  shall  be  capable  of  withstanding  the 
loads  specified  In  3. 2. 3. 2.1. 

DISCUSSION 

Mechanical  computation  equipment  Includes;  mechanisms  and  hydraulic  and 
pneumatic  components  for  scheduling,  comparing,  summing,  computing.,  and 
gain  changing  as  required  for  Input/output,  mode  control,  and  signal  conver- 
sion and  transmission,  Most  of  these  computation  elements  are  subjected  to 
the  same  loads  applied  to  other  signal  transmission  components. 

3. 2. 4. 2. 2 Geared  mechanisms.  All  geared  mechanisms  used  In  mechanical 
computer  components  shall  meet  the  requirements  of  MIL-G-6641. 

DISCUSSION 

Mechanical  computer  geared  elements  shall  be  designed  so  that  backlash, 
friction,  and  Inertia  are  minimized  as  necessary  to  provide  adequate  sensi- 
tivity between  the  input  and  output  of  the  computer. 

3. 2. 4. 2. 3 Hydraulic  elements.  Hydraulic  computing  elements  shall  be 
designed  in  accordance  with  MIL-C-5503,  MIL-H-8775,  MIL-G-8890  or  ARP  1281 
as  applicable.  Specification  MIL-V-27162  shall  be  used  as  a general  guide 
for  the  design  of  control  valves  used  in  hydraulic  computing  components. 

DISCUSSION 

Requirements  for  hydraulic  elements  of  mechanical  computers  that  are 
integrated  into  the  flight  control  system  must  be  consistent  with  the  require- 
ments for  other  hydraulic  elements  in  the  system. 

The  performance  characteristics  of  valves  used  in  computers  must  be 
adequate  for  the  computer  to  achieve  its  required  performance  having  taken 
into  consideration  the  effect  of  valve  gain  and  friction  on  valve  stability 
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and  liystoi'etilb , Vibration  of  the.  curaputei  unlr  diu  in;.;  iia r.t  onuance  testing 
as  a means  of  meeting  design  requirements  will  not  be  allowed  unless  the 
amp.lltude  and  frequency  of  vibration  is  equivalent  to  the  installed  vibra- 
tion environment  in  the  aircraft. 

3. 2. 4. 2. 4 bnjiuima_^ic  All  pnoumatit  computing  elements  shall  be 

designed  In  accordance  with  MIL -P-H.bbH  and  ALSO  Design  Handbook  DH  1-6, 
Section  3G,  Pressurization  ami  Pneumatic  Systems,  as  applicable. 


DISCUSSION 


Requii  eiuents  for  pneumatic  elements  of  mechanical  computers  that  are 
Integrated  Into  the  flight  control  system  must  be  consistent  with  the 
requirements  for  other  pneumatic  elements  in  the  system. 

A dynamic  and  steady-state  analysis  should  be  accomplished  on  mech- 
auLcai  computer  systems  to  define  the  effect  on  stability  and/or  stt ady- 
state  variations  caused  by  manufacturing  tolerances,  wear,  and  environmental 
conditions . 

Most  real  systems  are  nonlinear  to  some  extent,  but  tlie  usual  region  of 
operation  is  nearly  linear.  The  purpose  of  this  analysis  is  to  study  the 
effects  of  nonl inearitl es  and  parameter  variations  inherent  in  the  system, 
such  as  friction,  stlction,  backlash,  saturation,  tolerances,  wear,  and 
changes  due  to  environment,  which  can  be  coirsidered  and  the  system  designed 
so  that  any  adverse  effec.ts  are.  unimportant  or  are  compensated  for. 

Due  to  the  failure  immunity  requirements  stated  herein,  mechanical 
computers  must  be  designeo  such  that  the  airplane  is  capable  of  continued 
norma.l  fliglit  and  landing  after  any  single  failure  in  the  computer  system 
whose,  failure  probability  is  greater  than  extremely  remote. 

Requirements  for  mechanical  computers  that  are  integrated  into  the 
tliglit  control  systems  must  be  consistent  wltli  the  other  basic  system 
requirements.  Consideration  must  be  given  to  the  prevention  of  .jamming 
meclianical  computers  by  foreign  objects,  such  as  rags,  bolts,  and  nuts. 

This  may  be  acomplished  by,  but  not  limited  to,  auequate  clearance  between 
paita,  the  provision  of  shear  outs  and  funk  struts,  oj-  by  permanently 
attaclu'.d  oovtu's  as  the  design  d-lctates. 

3 . 2 . 4 . 3 Lvlecir  ica i_  s i computat  ions . 

DISCUSSION 


;\  1 I oicctrical  signal  cumputatious  lor  tlio  llight  control  system  may 
be  categorized  as  being  performed  by  eltlier  an  analog  or  a digital  computer, 
and  as  siicli,  are  subject  to  tlie  following  rociulrement a . Signal  computations 
iiK'.liide  siiuplt!  suramati'.jn  ai.d  amplification  as  wei  1 as  the  solution  of  complex 
automatic  fliglit  control  equations.  Analog  computer  equipment  includes 
hardwaie  components  required  for  Ininit /output , mode  control,  signal  pro- 
cessing, and  control  and  signal  tr.insmlssion.  Digital  computation  equipment 
uic.ludes  hardware  and  associated  software  for  data  processing,  program 
storage,  input/out  put , control,  and  signal  i ransmissian . 
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3.2.4.3.1  Analog  coinputatton.  Redundant  electrical  Hlgnnl  patl'S  within  a 
computer  shall  be  Isolated  as  required  by  failure  Immunity  and  Itivulnera- 
bility  requirement  specified  herein.  For  failures  whlc.lj  may  cause  a 
hazardous  deviation  In  the  aircraft  flight  path,  tlie  computer  shall  have 
provisions  for  rapidly  disabling  its  command  outputs  or  servos  unless  other 
fail-safe  provisions  exist. 

DISCUSSION 

The  failure  immunity  requirements  of  3.1..,'l  and  the  associated  relia- 
bility and  invulnerability  requirements  stated  herein  require  isolation  and 
separation  of  redundant  channels.  This  Isolation  should  exist  in  computer 
elements  as  well  as  in  signal  transmission  lines.  The  designer  should  take 
care  that  nonlinearities  and  variations  in  computer  component  characteristics 
due  to  tolerances,  wear,  aging,  and  environmental  conditions  do  not  result 
in  failure  to  meet  or  maintain  performance  or  stability  requirements  estab- 
lished for  the  computer.  Careful  design  will  be  required  to  satisfy  the 
stability  margin  requirements  specified  herein  at  the  system  level. 

3.2.4. 3.2  Digital  computation.  At  the  time  of  aircraft  acceptance  by  the 
procuring  activity,  the  total  time  used  In  flight  control  computations  for 
worst  case  conditions  shall  not  exceed  75  percent  of  the  available  computa- 
tion time  allocated  for  flight  control  use.  Resident  and  bulk  storage  shall 
be  sized  such  that  at  least  25  percent  of  each  type  is  available  for  growth 
at  the  time  of  aircraft  accept anoe.  Computation  and  sample  rate  shall  be 
established  at  a level  which  ensures  that  the  digital  computation  process 
will  not  introduce  unacceptable  phase  shltt-  round  off  error,  nonlinear 
characteristics,  and  frequency  foldover  or  aliasing  into  tlie  system  response. 

3. 2. 4. 3. 2.1  Memory  protection.  Memory  protection  features  sliall  be  pro- 
vided to  avoid  inadvertent  alteration  of  memory  contents.  Memory  protection 
shall  be  such  that  neither  electrical  power  source  transients  v;ithiii  the 
limits  specified  nor  FMJ  as  .«ptH-ifled  in  3. 2. 5. 4.1  shall  cause  Itess  ot 
program  memory,  memorv  .sc iamb le,  erroneous  commands,  ('r  loss  of  abtliiy 

for  continued  oper.atlon.  The  transients  shall  be  as  specified  in  N]L-S']T'-7U4 
for  Category  C ut  lllj'.at  Ion  equipment.  For  applications  where  system  failures 
could  be  hazardous  to  safety  of  flight,  the  levels  for  normal,  abnormal, 
and  emergency  electric  system  operation  shall  apply.  For  applications 
which  are  not  critical  to  safety  of  flight,  the  levels  for  normal  operatl'^n 
shall  apply.  These  transient  requirements  .shall  apply  to  cases  when  all 
or  only  one  of  th?  redundant  power  sources  are  operating. 

3.2.4. 3.2.2  Program  scaling.  Paiameter  scaling,  word  size  input  limiting, 
and  overflow  protection  shall  ensure  correct  processing  and  continuous  safe 
operation  for  all  possible  comhlnatlon.s  of  nuineuvering  demand  and  gust  or 
other  plausible  disturbance  within  the  service  envelope  of  the  system.  Any 
condition  capable  of  producing  an  overflow  in  an  essential  or  flight  phase 
essential  function  shall  be  precluded  by  hardware  overflow  detection  and 
software  or  firmware  that  provides  for  data  recovery  and  continuous  safe 
operation  following  an  overflow.  Scaling  shall  provide  satisfactory  reso- 
lution to  prevent  the  granularity  due  to  digitizing  processes  from  intro- 
ducing, into  the  system  response,  unacceptable  levels  of  nonlinear 
characteriscics  or  Instabilities, 
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3.2.A.3.2.3  Software  support.  For  prograim&able  computers  a software  sup- 
port Dackage  shall  be  provided  to  aid  la  generation  and  validation  of  new 
programs.  This  support  package  shall  be  designed  to  be  executable,  either 
on  the  airborne  computing  system  for  which  It  was  designed  or  on  a large 
scale  digital  computer  specified  by  the  procuring  agency.  The  support 
package  shall  Include  the  necessary  software  and  appropriate  peripheral 
devices  In  accordance  with  the  contractor  deta  requirements  list  (DD  1A23). 

DISCUSSION 

One  of  the  more  Important  advantages  of  digital  computation  compared 
with  the  alternative  analog  mechanisation  Is  the  ability  to  modify  and  add 
to  the  functional  capability  of  the  original  system  with  minor  Impact  on 
cost.  This  flexibility  to  accept  changing  requirements  and  the  more 
universal  application  of  digital  computers  requires  that  the  deMvered 
equipment  have  spare  memory  capacity  and  spare  computation  time  available 
for  later  use.  Reference  12  describes  digital  vs.  analog  trades  kitade  In  a 
recent  development.  Conclusions  resulting  from  these  trades  are  presented 
for  the  AFCS  and  the  MFCS. 

Airborne  digital  computers  are  required  to  accept  electrical  power 
supplies  having  degraded  characteristics  compared  with  normal  power  specifi- 
cations for  ground  based  computers.  Considerable  care  Is  required  to  ensure 
that  the  transients  to  be  expected  In  airborne  electrical  power  generation 
do  not  cause  loss  of  program  memory.  No  special  requirements  should  be 
placed  upon  the  aircraft  electrical  power  system  because  digital  computation 
techniques  are  being  used. 

Fixed  point  processor  hardware  is  expected  to  be  used  for  airborne 
flight  control  applications  because  of  the  reduced  cost  of  this  mechaniza- 
tion. This  Implies  that  the  potential  exists  for  exceeding  the  word  size 
and  causing  overflow  during  arithmetic  operations.  The  computed  output  in 
this  event  can  go  from  large  signal  In  one  direction  to  a maximum  hardover 
In  the  opposite  direction.  The  program  scaling  requirement  Is  to  design  to 
ensure  that  the  software/hardware  design  is  adequate  In  this  regard. 

In  the  process  of  providing  overflow  protection  through  parameter 
scaling  and  word  sizing  there  la  an  Inherent  tradeoff  between  resolution 
and  signal  limiting.  The  effort  to  prevent  overflow  through  scaling  must 
not  degrade  the  resolution  to  a level  which  causes  unacceptable  limit  cycle, 
dead  band,  or  hysteresis  characteristics  in  the  system  response. 

Scaling  shall  provide  satisfactory  resolution  to  prevent  the  granu- 
larity due  to  the  digitizing  process  from  being  apparent  to  the  pilot  and 
providing  the  source  of  additional  excitation  energy  for  structural  elastic 
modes.  Further,  scaling  shall  provide  satisfactory  resolution  and  update 
rate  in  the  signal  to  the  servovalve  to  prevent  the  granularity  due  to  the 
digitizing  process  from  exciting  the  servovalve  in  an  unstable  mode. 
(Reference  79). 

Software  and  software  support  packages  are  needed  to  ensure  that  the 
procuring  activity  has  complete  control  over  maintenance  of  the  delivered 
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•qulpnont  and  the  ability  to  stake  ntodif  leaf  ions  as  required.  Where  general 
purpose  computers  are  used,  the  following  programs  should  be  provided: 
assembler  (or  computer),  linkage  editor  or  loader,  simulator  or  other  debug- 
ging aids. 

Program  documentation  must  be  included  as  a part  of  the  FCS  Analysis 
Report  (A. 4. 3.1).  Program  documentation  included  therein  should  include: 

A master  program  tape. 

A source  deck  corresponding  to  the  master  tape. 

Listings  of  the  program. 

Flow  charts  illustrating  the  program  organization,  timing  and 

logic. 


Input-Output  data  specifications. 

The  need  for  peripheral  device  is  determined  by  the  software  used. 
Typical  devices  include  card  and  paper  tape  readers,  roagretic  tape,  disc 
files,  high  speed  printers,  teletypewriters,  and  magnetic  tape  output. 

3.2.5  Control  power. 

3. 2. 5.1  Power  capacity.  Sufficient  electrical,  hydraulic,  and  pneumatic 
power  capacity  shall  be  provided  in  all  flight  phases  and  with  all  corres- 
ponding engine  speed  settings  such  that  the  probability  of  losing  the 
capability  to  maintain  at  least  FCb  Operational  State  III  airplane  perform- 
ance shall  be  not  greater  than  extremely  remote  when  considering  the  com- 
bined probability  of  system  and  component  failure  and  the  cumulative 
exceedance  probability  of  turbulence.  Hydraulic  power  shall  be  used  to 
actuate  powered  essential  and  flight  phase  essential  MFCS. 

DISCUSSION 

The  trend  toward  neutral  or  negative  aerodynamic  stability,  with 
increased  reliance  on  artificial  stabilization  in  high  performance  aircraft. 
Increases  surface  actuation  rate  demands.  This  in  turn  Increases  the  size, 
weight,  and  cost  of  tha  power  systems.  Therefore,  it  is  very  important  that 
a careful  analysis  of  requirements  be  made  as  early  as  possible  in  the  air- 
craft development  phase  since  these  requirements  impact  the  procurement  of 
many  long  lead  items  such  as  hydraulic  pumps,  control  valves,  reservoirs, 
tubing,  and  the  prime  movers  such  as  engine  power  takeoffs  and  APU's. 

In  many  cases,  the  power  requirements  can  only  be  optimized  by  deter- 
mining control  rate  requirements  on  a realistic  flight  simulator  "flown" 
by  typical  service  pilots.  The  simulation  should  include  turbulence 
Intensity  levels,  as  specified  in  3. 1.3. 7.  To  determine  control  surface 
rates  and  power  requirements  under  system  partial  failure  conditions, 
reduced  turbulence  intensities  (such  that  the  combined  probability  of 
turbulence  and  of  each  selected  failure  condition  equal  the  maximum  allow- 
able failure  rate  for  the  specified  flight-safety  reliability  requirement) 
should  be  used. 
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Tiu'  Inlt'nt  ol  t:ho  ri'qii  1 venunit  to  use  Itydraullc.  power  for  MFCS  la  not 
to  proliiblt  use  ot  ueroiivnnmlco  1 1 y boosted  (control  tab)  controla>  Use  of 
t'.l octr I ca  1 ni  piu'utiRt t I r power,  except  for  noncrltlcal  applications,  will 
requlfp  iipprova ) of  \e  proouritiH  activity. 

'<.1.5.;'  I'y • Kssentlal  and  flight  plinse  essential  flight  controls 
siia  1 1 lu.'  given  priority  over  uoi'crit  lc.al  controls  and  other  actuated 
functions  liming  s Imu Itmieou.c  denurnd  operation.  However,  no  specific 
priority  provisions,  such  as  hydraulic  priority  valves,  are  required  unless 
there  is  llkellltood  of  simultaneous  demands  which  could  prevent  one  or 
more  essential  or  flight  pliase  esstrutlal  actuation  systems  from  meeting 
tlieir  performance  requirements.  Where  provided,  priority  controls  shall  be 
lilghly  resist, \nt  to  deterioration,  binding,  or  failure  while  dormant  under 
normal  aircraft  operations  so  that  they  will  function  as  required  when 
cotulUlons  diet, ate.  If  flight  safety  can  be  endangered  by  failure  of  such 
controls,  grounil  checkout  meai\s  for  readv  determination  of  their  opera- 
hllltv  sh.aM  he  iirovided  and  procedures  specified. 

DISCUSSION 

Wltli  tlie  use  of  fully  powered  fllglit  control  systems  powered  by 
hydraulic  or  electric  systems  tlt.at  .also  supply  other  loads,  care  must  be 
taken  to  et\sure  that  power  demands  of  those  other  functions  do  not  deprive 
essential  fllgiit  control  actuation  subsystems  of  sufficient  power  to  perform 
their  functions.  In  many  cases,  the  power  demands  for  landing  gear  retrac- 
tion and  extension  are  greater  than  required  for  flight  control;  and,  during 
.laitding  gear  operatii'n  by  hydraulic  systems  which  also  supply  utility 
functions  (such  as  wliero  the  dedlcacod  hydraulic  system  has  failed),  pro- 
visions must  he  made  to  prevent  disruption  of  flow  to  the  essential  flight 
cont  Vo  1 . 

I.'’.').  I Hydraulic  p wer_  subsystems . All  hydiaultc  power  generated  and 
' i s t r i.hu  t i "II  evst  .I'.',  ii'n.ially  used  for  flight  control  shall  be  designed  In 
iccoidancc  with  MU,-ll-54<'iU  and  M U.-Il --H89I  as  applicable.  The  FCS  shall 
operate  in  accordance  with  this  specification  when  supplied  with  such 
hydraulic  powt?r.  Apj'licahle  requirements  In  AFSC  Design  Handbook  DH  1-6, 
Systems  Safct>’,  Section  U’,  ilydr.uillc  Systems,  shall  also  be  met. 

1)1  StdiSS  ION 


hvilraulii-  po\,’ci  lo'r  u -ic  vltl>  t ni  1 y -powered  essential  and  flight  phase 
csunitial  MR  S,  is  spocli  'cd  o.i  tile  basis  of  proven  performance  and  ability 
to  privlde  high  force  outputs  witli  minimum  weiglit.  Use  of  electrlcal- 
im'chan.,cal  actual  U'n  or  pneumatic  power  will  require  justification  and 
specific  approval  by  the  procuring  activity.  Development  work  directed 
towcard  use  ot  liquid  metal  as  hydraulic  fluid  is  described  in  Reference 
81,  and  may  be  further  pursued  in  the  future. 

Requirements  stated  herein  which  may  determine  hydraulic  capacity 
include;  MFCS  .and  AFCS  performance  (3.1.1  and  3.1.2),  failure  immunity  and 
safety  (3  1.3. 2)  and  opeiaticui  in  turbulence  (3. 1.3. 7). 
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Redundancy  is  specified  by  3.1. 3.1  at  the  system  level.  However,  it 
must  be  recognieed  that  hydraulic  system  failures  can  be  a major  cause  of 
flight  control  system  failure,  and  the  MIL-H-5A40  requirement  to  keep  at 
least  one  system  free  of  any  noncritical  system  functions  has  been  in 
effect  for  many  years.  There  are  many  aircraft,  however,  which  require 
two  or  more  power  sources  for  actuation  of  utility  or  noncritical  flight 
control  functions.  In  the  past,  these  have  often  been  actuated  by  an 
alternate  power  means,  such  as  a stored-gas-hlgh-pressure  pneumatic  system 
for  emergency  landing  gear  extension,  or  an  electric  motor  for  emergency 
flap  extension.  However,  as  such  loads  become  higher,  such  as  due  to 
Increased  aircraft  size  or  speed,  there  is  more  incentive  to  operate 
hydraulically.  Therefore,  if  it  is  clearly  shown  that  significant  penal- 
ties can  be  avoided  by  t,-.  i.lizlng  the  "dedicated"  hydraulic  system  as  an 
alternate  source  of  power  for  the  utility  or  noncritical  fllpht  control 
function,  the  procuring  activity  may  entertain  a request  for  deviation  to 
the  MIL-H-5440  requirement  if  a reliable  isolation  shutoff  valve  can  be 
provided . 

3. 2. 5. 4 Electrical  power  subsystems.  All  electrical  power  generation  and 
distribution  subsystems  used  for  flight  control  shall  provide  electrical 
power  in  accordance  with  MIL 'STD-704.  The  PCS  shall  operate  in  accordance 
with  this  specification  when  supplied  with  power  in  accordance  with 
MIL-STD-704.  Applicable  requirements  in  the  following  AFSC  design  hand- 
books shall  be  met: 


a. 

DH 

1-4: 

Electromagnet!.:  Compatibility. 

b. 

DH 

1-6: 

System  Safety. 

c. 

DH 

2-1: 

Airframe. 

d. 

DH 

2-2: 

Crew  Stations  and  Passenger  Accommodations. 

Electiical  systems  which  provide  power  to  essential  or  flight  phase 
essential  controls,  shall  insure  uninterruptible,  isolated  redundant  power 
of  adequate  quality  to  meet  FCS  requirements  aTter  any  malfunction  not 
considered  extremely  remote.  Such  electrical  systems  shall,  except  for 
basic  power  source,  be  independent  of  failure  modes  associated  with  any 
other  electrical  system.  Essential  and  flight  phase  essential  FCS  shall 
be  automatically  provided  alternate  sources  of  power  wheie  interruption 
could  result  in  operation  below  FCS  Operational  State  III,  A protected 
alternate  source  of  power  shall  be  provided  for  all  essential  or  flight 
phase  essential  control  signal  transmission  paths  sufficient  to  continu- 
ously maintain  at  least  FCS  Operational  State  III  performance  in  the  tvent 
of  loss  of  all  electrical  power  supplied  from  engine-driven  generators. 
Control  systems  employing  both  ac  and  dc  power  inputs  shall  normally  have 
interlocks  incorporated  to  disconnect  both  power  inputs  should  either  type 
of  power  be  lost.  However,  if  the  loss  of  either  power  source  can  be  shown 
to  be  equivalent  to  loss  of  both  or  FCS  Operational  State  III  or  better  is 
maintained  with  either  power  source,  interlocks  are  not  required. 
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3. 2. 5. 4.1  Eleetronmgnet  ic  Interference  limits.  Tlie  PCS  shall  operate 
within  the  limits  of  MIL-E-6051  and  MIL-STD-461  environment.  Electro- 
magnetic interference  created  by  the  systems  and  components  during  normal 
operation  shall  be  within  the  limits  of  MIL-E-6051  and  MIL-STD-461, 
respectively.  Failure  modes  of  all  onboard  systems  and  equipment,  includ- 
ing flight  controls,  wherein  these  limits  may  be  exceeded  shall  be  identi- 
fied in  addition  to  sources  of  conducted  EMI  that  may  be  detrimental  to 
PCS  operation.  Additionally,  the  estimated  magnitude  of  EMI  generated  by 
these  failure  modes  shall  be  provided  for  the  assessment  of  the  safety  of 
the  EFCS. 

3. 2. 5. 4. 2 Overload  protection.  Overload  protection  of  the  primary  power 
wiring  to  the  system  or  component  shall  be  provided  by  the  airplane  con- 
tractor. Installation  requirements  of  the  system  or  component  specif ica- 
lion  shall  specify  the  values  of  starting  current  versus  time,  surge 
currents  if  applicable,  normal  operating  current,  and  recommended  protec- 
tive provisions.  Additional  protection  as  necessary  shall  be  provided 
within  the  system  or  component.  Such  circuit  protection  shall  not  be 
provided  in  signal  circuits  or  ocher  circuits  where  opening  of  the  protec- 
tive devices  will  result  in  unsafe  motion  of  the  aircraft. 

3. 2. 5. 4. 3 Phase  separation  and  polarity  reversal  protection.  In  systems 
affecting  flight  safety,  phase  revt  sal  and  polarity  reversal  shall  P 
prevented  as  far  as  practical  by  keying,  physical  restraints  or  other 
positive  means. 

DISCUSSION 

electrically  powered  controls  which  can  be  considered  essential  to  safe 
flight  include  APCS  auuoland  controls,  certain  command  augmentation  and 
stability  augmentation  systems,  and  all  Electrical  Flight  Control  (fly-by- 
wire)  systems.  In  order  to  meet  flight-safety  requirements,  these  systems 
ace  redundant  so  tliat  the  critical  control  function  will  be  maintained 
even  when  failures  occur.  Their  electrical  power  sources  in  the  PCS  and 
from  the  aircraft  must  be  equally  dependable  and  redundant. 

The  requirement  for  redundancy  has  the  greatest  impact  on  the  design 
of  generating  system  configurations.  A single  fault  on  any  part  of  a 
paralleled  multichannel  generating  system  will  result  in  loss  of  power  to 
all  airplane  systems  until  the  fault  is  cleared.  During  certain  extreme 
cases,  this  could  fake  up  to  3 or  4 seconds  and  could  occur  during  a 
critical  period  such  as  the  final  moments  of  an  automatic  landing.  Electri- 
c'l  isolation  of  the  generating  systems  would  prevent  a single  fault  from 
Eecting  more  than  one  channel  of  flight-critical  eq-’ipment. 

The  degree  of  isolation  and  the  number  of  isolated  channels  that  may  be 
required  will  be  dependent  on  the  specific  requirements  for  the  airplane  in 
question.  In  general,  an  independent  source  of  electrical  power  will  be 
required  for  each  redundant  channel  of  essential  or  flight  phase  essential 
'.'ontrol  systems. 
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Isolated  Versus  Parallel  Operation  of  Generators 


Parallel  operation  of  multichannel  (three  or  more)  generating 
systems  may  offer  considerable  performance  and  economic  advantages  over  a 
system  composed  of  isolated  channels.  However,  parallel  operation 
Includes  the  possibility  of  a single  fault  causing  trips  of  mere  than  one 
channel  or  an  overload  m.omentarlly  affecting  and  degrading  power  to  all 
airplane  loads.  Also,  the  load  division  circuitry  required  for  parallel 
operation  adds  complexity  to  the  generating  system  and  increases  the 
chances  for  malfunctions  which  could  cause  the  temporary  loss  of  one  or 
more  generating  channels. 

Essential  and  flight  phase  essential  control  syste.MS  are  provided 
in  varying  degrees  of  redundancy,  and  this  imposes  the  requlrcr.ent  that 
power  sources  to  these  systems  be  equally  reliable.  A parallel  system.  If 
composed  of  three  or  four  generating  channels,  will  be  a highly  reliable 
source,  but  it  is  vulnerable  to  several  single  failure  ..lodes  (failure  of 
current  transformer  shorting  contacts,  excitation  loss,  open  current  trans- 
former loop,  main  bus  or  load  circuit  faults,  synch  bus  faults),  which  can 
transiently  interrupt  or  seriously  degrade  the  quality  of  power  on  all  main 
buses  simultaneously.  Abnormal  power  quality  will  be  supplied  to  all  loads 
for  a time  ranging  from  0.020  to  3.0  seconds.  This  time  is  dependent  on 
the  specific  type  of  failure  and  the  delays  associated  with  the  protective 
circuitry.  It  should  bo  noted,  however,  that  simultaneous  failures  will 
be  normally  of  very  short  duration  and  will  be  automatically  cleared  from 
all  but  the  faulted  bus.  In  the  unlikely  event  that  multiple  failures 
result  in  an  inability  of  the  system  to  automatically  clear  a fault,  proper 
crew  action  can  restore  power  to  the  unfaulted  buses.  Past  experience  shows 
that  nuisance  trips  can  occur  which  may  result  in  overloading  of  the  remain- 
ing channels  and  a brief  "all  power  lost"  situation. 

The  required  reliability  of  power  sources  may  be  provided  most 
simply  by  isolating  redundant  gene’,  ting  channels  and,  in  effect,  providing 
two,  three,  or  four  generating  channels  with  no  interconnecting  ties  between 
buses.  This  isolation  ensures  that  a fault  on  one  channel  cannot  alfect  the 
others.  However,  isolation  also  means  that  system  overload  capabilities  are 
decreased  from  those  of  a parallel  system  of  equal  rating;  and,  isolation 
may  Impose  weight  penalties  on  the  airplane  design  if  sufficient  generating 
system  capacity  with  provisions  for  future  growth  and  overload  capability 
is  to  be  obtained.  The  degree  to  which  power  sources  must  be  isolated  is 
peculiar  to  each  design  and  application. 

Redundant  Power  Sources 


The  concept  of  isolation,  as  mentioned  i the  paragraph  above, 
provides  redundancy  equal  to  the  number  of  generat^ng  channels.  The  redun- 
dancy of  power  sources,  however,  is  expected  to  be  equal  to  the  number  of 
redundant  channels  of  flight -critical  equipment.  Autoland  systems  are 
being  proposed  in  triple  redundant,  fail-operative  versions.  If  this 
system  was  installed  in  a two-engine  airplane  (two  isolated  generating 
channels)  a third  power  source  should  be  provided.  A battery-inverter 
standby  system  may  be  considered  as  a redundant  source,  but  its  capacity 
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severely  limits  the  loads  which  can  be  operated  from  it.  A third  isolated 
generating  channel,  operating  continuously,  would  be  required  to  satisfy 
the  redundancy  definition,  and  its  capacity  must  be  adequate  for  one  set 
of  load  equipment.  Monopropellant  emergency  power  turbine  generators  are 
now  being  installed  in  several  fighter  aircraft  for  an  independent  backup 
power  source. 

A combination  of  parallel  and  isolated  operation  can  also  be  con- 
sidered (for  example,  a four  channel  system  operating  with  channels  one  and 
two  paralleled  and  channels  three  and  four  parralleled,  but  one  aad  two  are 
isolated  from  three  and  four).  These  four  channels  are  essentially  two 
isolated  sources,  and  if  more  redundancy  is  required,  additional  Isolated 
sources  would  be  required. 

Power  Limiting  Devices 

As  mentioned  above,  the  degree  of  isolation  of  isolated  generating 
system  channels  can  be  compromised  by  a swltchable  bus.  A transfer  bus  (to 
which  essential  loads  are  connected)  is  generally  arranged  so  that  loss  of 
power  to  it  would  cause  it  to  be  transferred  to  the  alternate  source  of 
power.  This  switching  capability  may  well  compromise  the  integrity  of  both 
of  these  power  sources  in  that  a fault  in  the  critical  load  equipment  (or 
on  its  bus)  could  be  applied  to  one  bus  and  then  the  other  after  switching. 
For  this  reason,  a transfer  bus  scheme  should  not  be  considered  for  rn  air- 
plane with  essential  electrical  control  systems  unless  a device  is  Included 
in  series  with  the  transfer  bus  that  eliminates  the  possibility  of  a single 
fault  causing  unacceptable  disturbances  to  more  than  one  power  source. 

The  development  of  a practical  and  reliable  power  (or  current) 
limiting  device  for  this  purpose  would  simplify  power  system  design  for 
critical  loads.  Some  of  the  basic  requirements  of  a power  limited  device 
are  as  follows: 


Sized  to  coordinate  with  the  largest  thermal  circuit  breaker 
connected  to  the  priority  bus. 

Sized  to  carry  the  maximum  startup  load  connected. 

Capable  of  dissipating  the  electrical  losses  incurred  during 
maximum  load  and  faulted  operation. 

Self-cooling — no  cooling  air  would  be  supplied. 

Reliability  must  be  of  exceptionally  high  order. 

Failures  must  be  passive,  i.e.,  must  not  fault  the  main  bus 
due  to  component  failure  of  the  device. 

Waveform  deterioration  during  limiting  mode  must  not  be 
severe  enough  to  cause  damage  to  any  of  the  connected  loads. 
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3. 2. 5. 5 Pneumatic  power  subsystems.  Pneumatic  power  using  ram-air,  engine 
bleed  air,  -•"■nred  gas,  mechanically  compressed  air,  or  generated  gas  may  be 
used  for  noncrltical  flight  control  functions  and  for  driving  hydraulic 
pumps  and  exectric  generators.  High  pressure  pneumatic  systems  used  for 
PCS  functions  shall  conform  to  MIL-P-5518,  the  applicable  requirements  in 
AFSC  Design  Handbook  DH  1-6:  System  Safety,  Section  3G:  Pressurization 

and  Pneumatic  Systems,  and  the  applicable  requirements  under  3. 2. 5.1, 
Hydraulic  Power  Subsystems,  herein.  Engine  bleed  air  systems  shall  conform 
to  MIL-E-38453. 

DISCUSSION 

This  requirement  was  expanded  to  include  ram-air  and  engine  bleed  air 
sources  in  recognition  that  low-pressure  pneumatic  sources  are  readily 
available  on  jet  aircraft  and  have  been  and  will  continue  to  be  considered 
and  used  for  powering  noncrltical  flight  control  functions.  Neither  high- 
pressure  nor  low-pressure  pneumatic  sources  appear  feasible  for  powering 
essential  or  flight  phase  essential  functions,  other  than  hydraulic  pumps 
and  electric  generators,  at  this  time. 

This  requirement  is  not  meant  to  apply  to  boundary  layer  control  as 
may  be  used  for  short  field  takeoff  a.id  landing  applications. 

3.2.6  Actuation 


3 . 2 . 6 . 1 Load  capability 

3. 2. 6. 1.1  Load  capability  of  elements  subjected  to  pilot  loads.  Elements 
of  actuation  systems  subjected  to  loads  generated  by  the  pilot (s)  shall  be 
capable  of  withstanding  the  loads  due  to  the  pilot's  input  limits  specified 
in  MIL-A-8865,  Section  3.7,  Flight  Control  System  Loads,  taken  as  limit 
loads,  unless  higher  loads  can  be  imposed  such  as  by  a powered  actuation 
system  or  loads  resulting  from  aerodynamic  forces.  Control  signal  boost 
actuator  outputs  may  be  load  limited  by  spring  cartridges. 

3. 2. 6. 1.2  Load  capabilicy  of  elements  driven  by  power  actuators.  Elements 
subjected  to  loads  generated  by  a powered  actuation  system,  including  all 
parts  of  the  actuator  shall  be  capable  of  withstanding  the  maximum  output 
of  the  actuation  system,  including  loads  due  to  bottoming,  or  the  maximum 
blowback  load,  as  controlled  by  pressure  relief  valves  or  other  load 
limiting  provisions,  whichever  is  greater,  as  the  limit  load.  Ultimate 
load  capability  shall  be  1.5  times  limit  load.  In  dual  load  path  design, 
each  path  shall  be  capable  of  sustaining  load  as  specified  in  3.1.11.1.2 
without  failure. 

DISCUSSION 

These  requirements  tiave  been  included  to  clearly  define  the  load  capa- 
bility requirements  for  both  the  signal  input  and  the  output  force  elements 
of  actuation  subsystems  and  apply  to  control  signal  boost  actuators  as  well 
as  to  surface  positioning  actuators. 


3. 2. 6. 2 Mechanical  force  transmitting  actuation.  For  control  cable  actua- 
tion, the  requirements  specified  in  3.2. 3.2.4  and  subparagraphs  apply.  For 
push-pull  rod  actuation,  the  requirements  specified  in  3.2. 3.2.5  and  sub- 
paragraphs  apply. 

3. 2. 6. 2.1  Force  transmitting  powerocrews.  Powerscrews  with  rotary  input 
and  linear  output  motion  may  be  used  to  actuate  relatively  low-duty-cycle 
flight  control  surfaces,  such  as  wing  flaps  and  trlmmable  stabilizers,  but 
specific  approval  from  the  procuring  activity  shall  be  obtained  before  use 
in  high-duty-cycle  applications.  Nonjamming  mechanical  stops  shall  be  pro- 
vided at  both  ends  of  the  screw  to  limit  travel  of  the  nut;  and,  they  shall 
be  designed  to  withstand  all  possible  loads,  including  possible  impact 
loading,  without  failure.  Provisions  shall  be  incorporated  into  the  nut 

to  minimize  entry  of  sand,  dust,  and  other  contaminants;  to  retain  its 
lubricant;  and  to  preclude  the  entry  or  retention  of  water.  However,  posi- 
tive sealing  is  not  required  if  the  screw  is  installed  such  that  it  is 
protected  from  such  contamination  or  is  inherently  resistant  to  wear  and 
jamming  by  contamination. 

3. 2. 6. 2. 1.1  Threaded  powerscrews . Standard  thread  forms  only  shall  be  used, 
and  the  thread  roots  shall  be  rounded  as  necessary  to  preclude  stress  crack- 
ing. Lubrication  provisions  shall  be  adequate  for  controlling  efficiency, 
wear,  and  heating  to  acceptable  values.  Where  in  service  lubrication  is 
necessary,  lube  fittings  in  accordance  with  3.2. 7.2.5  shall  be  provided. 

If  the  design  is  dependent  on  inherent  friction  to  maintain  irreversibility, 
this  characteristic  must  be  adequate  under  all  expected  operating  conditions, 
including  the  full  range  of  loads,  both  steady  loads  and  reversing  or 
variable-magnitude  loads  which  may  be  encountered  due  to  control  surface 
buffeting  or  buzz,  temperatures,  and  environmental  vibration  over  the  full 
service  life  of  the  unit. 

3. 2. 6. 2. 1.2  Ballscrews . An  adequate  number  of  balls  and  ball  circuits  shall 
be  provided  to  keep  individual  ball  loading  within  allowable  nonbrinelling 
limits.  On  units  used  in  essential  and  fliglit  phase  essential  applications, 
at  least  two  separate  independent  ball  circuits  and  a secondary  load  path 
with  load  capability  per  3.1.11,1.2  shall  be  incorporated. 

DISCUSSION 

Force  transmitting  powerscrews  have  been  used  for  a long  time  for  non- 
critical  flight  control  applications  (e.g.,  landing  gear  actuation  on  B-17, 
B-29,  B-50,  and  B-47  airplanes,  and  flaps  and  stabilizer  trim  on  B-52,  KC-135, 
and  many  commercial  airliners),  but  as  yet  not  for  actuation  of  essential 
control  surfaces.  The  requirement  that  specific  approval  must  be  obtained 
before  using  powerscrews  for  high-duty-cycle  applications  is  not  intended 
to  prohibit  their  use,  but  rather,  to  ensure  that  the  contractor  has  fully 
investigated  their  capability  to  perform  reliably  under  required  conditions 
and  can  present  substantiating  evidence  for  approval  before  committing  the 
design.  Trim  actuators  including  those  commanded  by  AFCS,  are  usually  con- 
sidered in  the  low-duty-cycle  category.  A nonjamming  stop  is  one  which  does 
not  prevent  actuation  of  the  nut  by  the  normal  means. 


One  detail  point  to  note  here  is  that  highly  loaded  threaded  powor- 
screws  develop  considerable  friction,  and  the  design  and  lubrication 
provisions  must  be  thoroughly  evaluated  by  analysis  and  supplemented  by 
rigorous  testing  under  realistic  operating  conditions.  Lubrication 
provisions  must  be  adequate  for  controlling  efficiency,  wear,  and  heating 
to  acceptable  values. 

A prime  example  is  the  F-111  Acme  threaded  powerscrew  used  for  variable 
wingsweep  actuation.  An  extensive  trial  and  error  development  program,  in 
which  a great  number  of  material  combinations  were  evaluated,  was  required 
to  produce  the  grease-lubricated  teflon  and  fiberglass  cloth  lined  screw 
nut  design  which  eventually  met  the  design  requirements. 

3. 2. 6. 3 Mechanical  torque  transmitting  actuation.  Specific  approval  from 
the  procuring  activity  must  be  obtained  before  use  of  such  provisions  in 
essential  and  flight  phase  essential  applications.  Backlash  accumulation 
shall  not  prevent  the  system  from  performing  its  required  function  throughout 
the  service  life  of  the  airplane. 

3. 2. 6. 3.1  Torque  tube  systems.  Torque  tubes  which  are  exposed  to  possible 
misuse,  such  as  support  for  maintenance  personnel,  shall  be  shielded  from 
such  misuse  or  shall  be  of  adequate  stiffness  to  prevent  damage  to  the  instal- 
lation. Each  torque  tube,  in  a linked  run  of  tubes  shall  be  removable  and 
relnstallable  in  the  aircraft  without  disturbing  the  support,  component,  or 
other  interfacing  system  element  at  either  end  of  the  torque  tube.  Guards 
which  are  capable  of  containing  a broken  torque  tube  against  thrashing  shall 
be  installed  in  appropriate  locations  to  prevent  damage  to  wiring,  tubing, 

and  other  equipment.  The  rated  operating  speed  of  a torque  tube  system 
sha'l  be  no  greater  than  75  percent  of  the  critical  speed. 

3. 2. 6. 3. 1.1  Torque  tubes.  Torque  tubes  shall  have  a minimum  wall  thickness 
of  0.035  inch  and  shall  be  seamless,  except  that  steel  tubes,  seam  welded  by 
the  electrical  resistance  method,  may  be  used. 

3. 2. 6. 3. 1.2  Universal  .joints.  Universal  joints  shall  be  in  accordance  wiili 
MIL-J-6193  or  MIL-U-3963,  as  specified  in  AFSC  Design  Handbook  DH  1-2,  Gen- 
eral Design  Factors,  Section  AC,  Universal  Joints,  and  shall  not  be  used 

for  angularities  greacer  than  specified  therein  or  recommended  for  the 
specific  component  by  the  manufacturer. 

3. 2. 6.3. 1.3  Slip  joints.  Adequate  engagement  shall  be  provided  to  insure 
that  disengagement  will  not  occur  under  all  expected  operating  condlt iiuis , 
or  due  to  buildup  of  adverse  manufacturing  and  installation  tolerances. 

DISCUSSION 

Torque  tubes  systems  have  been  used  on  many  aircraft,  primarily  for 
actuation  of  trailing  edge  flaps,  and  the  foregoing  requirements  have  become 
well  established.  The  requirement  that  specific  approval  is  required  before 
using  torque  transmissions  in  essential  applications  is  not  intended  to 
prohibit  their  use,  but  rather  to  ensure  that  the  contractor  has  fully  Inves- 
tigated all  components,  e.g.,;  gear  boxes,  powerscrew.s , rotary  actuators, 
etc.,  to  ensure  they  can  perform  reliably  under  all  operating  conditions. 
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All  torque  tubes  should  be  mounted  on  antifriction  bearings  with 
supported  couplers  (jackshafts  moutkted  to  structure  on  antifriction  bear- 
ings) epaced  at  close  enough  intervals  and  with  sufficient  misalignment 
capability  (within  the  couplers)  to  prevent  undesirable  bending  or  whipping 
of  the  tubes,  In  addition,  the  prevention  of  spark  generation  in  fuel 
system  areas  should  be  given  careful  consideration  in  the  detail  design. 

A minimum  of  parts,  Joints,  and  related  components  should  be  used  to 
accomplish  the  required  purpose;  however,  it  must  be  possible  to  remove  the 
torque  tube  sections  from  the  airplane  and  replace  them  readily. 

3.2.6. 3.2  Gearing.  All  gear  boxes  used  in  actuating  systems  shall  meet 
the  requirements  specified  in  MIL-G-66^1. 

3.2.6. 3.3  Flexible  shafting.  Flexible  shafting  may  be  used  providing  that 
minimum  bend  radii,  rated  rotational  speed,  and  rated  torque  are  not  ex- 
ceeded, and  that  extreme  temperatures  and  other  operational  variations  and 
environments  do  not  cause  binding.  Flexible  shafts  shall  be  Installed  with 
the  fewest  possible  bends  and  shall  be  securely  fastened  to  supporting 
structure  at  close  intervals. 

3.2.6. 3.4  Helical  splines.  Involute  helical  splines  shall  use  only  the  ASA 
standard  tooth  forms  Numbers  1 through  5.  Ballsplines  shall  meet  the 

' requirements  specified  in  3. 2. 6. 2. 1.2  for  ballscrews. 

[ DISCUSSION 

[ Helical  splines  (also  known  as  Yankee  screw  drivers)  have  not  yet  been 

I used  in  flight  control  actuation  systems  but  are  getting  more  and  more 

f attention  as  the  needs  to  design  mechanisms  which  can  transmit  high  torque 

[!  (or  translate  linear  force  to  torque)  in  thin  airfoil  sections  increase. 

[ When  used,  lubrication  provisions  must  be  adequate  for  controlling 

[ efficiency,  wear,  and  heating  to  acceptable  values.  If  the  design  is 

i dependent  on  inherent  friction  to  ir.aintain  Irreversibility,  this  character- 

istic must  be  adequate  under  all  expected  operating  conditions  including 
the  full  range  of  loads,  temperatures,  and  environmental  vibration  over  the 
full  service  life  of  the  unit,  both  steady  loads  and  reversing  or  variable- 
magnitude  loads  which  may  be  encountered  due  to  control  surface  loads, 
buffeting,  or  buzz. 

3.2.6, 3.5  Rotary  mechanical  actuators.  Rotary  mechanical  actuators  used 
with  a through  shaft  which  attaches  to  torque  tubes  at  both  ends,  thus 
serving  as  a portion  of  the  torque  distribution  system,  shall  be  capable  of 
reacting  full  system  torque  in  both  the  forward  direction  (due  to  a jam 
anywhere  in  the  system)  or  in  the  backdriving  direction  (due  to  overrunning 
load),  unless  provided  with  a torque  limiter  and  nc-back  brake  or  other 
devices  which  would  preclude  such  loading. 

3.2.6. 3.6  Torqua  limiters.  Where  used,  torque  limiters  designed  to  slip  or 
lock  to  adjacent  structure  shall  be  properly  located  in  the  transmission 
system  to  prevent  drive  loads  in  excess  of  control  surface  limit  load  from 
being  transmitted  past  the  limiter  in  the  event  of  overload  or  jamming. 
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The  rate  of  application  of  the  limiter (s)  and  the  sprin^^  rate  of  the.  trauy- 
ralssion  system  shall  be  matched  so  that  the  stress  In  any  member  due.  to 
sudden  application  does  not  exceed  its  yield  strength. 

3.2.6. 3.7  No-Back  brakes.  No-back  brakes  shall  prevent  back  driving  (or 
feedback)  forces  imposed  on  the  output  of  an  actuating  mechanism  t rom 
being  converted  to  torques  which  cun  cause  the  input  shaft  to  rotate.  In 
no-back  brakes  of  the  dissipative  type,  provisions  shall  be  included  to 
distribute  beat  generated  by  the  brake  so  that  temperature  llmltatious  are. 
not  exceeded. 

DISCUSSION 

Rotary  mechanical  actuators  (often  referred  to  as  power  hinges)  with 
torque  limiters  and  no-back  brakes  have  been  used  In  some  relatively  recent 
applications  e.g.,  wing  tip  fold  actuation  on  the  RS-70,  weapon  bay  door 
actuation  on  the  F-111,  and  leading  edge  flap  actuation  on  the  Boeing  747) 
but,  prior  to  their  selection  tor  actuation  of  the  B-1  rudder,  have  not 
been  used  for  actuation  of  a primary  control  surface. 

As  an  alternate  to  a no-back  brake,  a mechanically  Irreversible  actuator 
may  be  used  providing  it  can  react  rated  static  limit  load  applied  to  the 
output  coupling  with  the  input  coupling  discomiected , without  being  back- 
driven  while  being  subject  to  any  vibration  condition  within  the  required 
vibration  envelop  or  spectrum.  Where  torque  limiters  are  used,  it  is 
desirable  that  they  release  upon  removal  of  the  downstream  jamming  load 
without  a requirement  for  change  in  the  upstream  torque  value  or  direction. 

3. 2. 6. 4 Hydraulic  actuation.  Hydraulic  actuation  components  sl^all  be 
designed  in  accordance  with  MlL-H-8775  or  MIL-H-8890,  and  specific  component 
specifications  as  applicable.  If  hydraulic  bypass  provi.slons  are  necessary 
to  prevent  fluid  lock  or  excessive  friction  load  oi  damping,  bypassing  and 
resetting  shall  occur  automatically  when  system  pressure  drops  below  or 
returns  to  the  minimum  acceptable  value  for  actuation.  In  actuation  systems 
designed  for  manual  control  following  hydraulic  failure,  provisions  sliail  he 
made  to  permit  bypassing  of  the  hydraulic  systems  fo*.  checkout  purposes  and 
to  permit  pilot  training  with  the  emergency  manual  system. 

3. 2. 6. 4.1  Hydraulic  servoactuators . Hydra  servoactuators  shal.1  be 

designed  in  accordance  with  ARP  1281.  Elec,  traulic  servovalves  shall  be. 
designed  in  accordance  with  MIL-V-27162.  If  ei ectrical -input  hydraulic 
servovalves  having  mechanical  feedback  of  actuator  position  are  used,  the 
applicable  requirements  of  ARP  988  shall  be  met. 

DISCUSSION 

The  availability  of  ARP  1281  by  the  SAE  allows  the  deletion  of  a number 
of  detail  design  requirements  for  hydraulic  servoactuators  from  this  speci- 
fication. It  is  prepared  in  the  l ormat  of  a MIL  spec  If  leal  ion , and  Is  plannci 
to  be  released  as  such  following  proper  coordination. 
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MIL-V-27162  for  electrohydraullc  servovalves  has  recently  been  updated 
incorporating  application  requiretnenta  in  ARP  490.  Electrohydraullc  servo- 
valves with  mechanical  feedback  of  actuator  position  are  not  generally  used, 
and  ARP  988  is  considered  adequate  at  this  time.  One  application  where 
they  were  used,  which  was  used  as  the  primary  model  for  the  requirements  in 
that  document,  was  in  the  spoiler  servoactuators  on  the  F-111. 

Actuator  Stability 

ARP  1281  specifies  that  the  detail  specification  shall  indicate 
required  servoactuator  and  mounting  structure  spring  rate,  structural  mount- 
ing arrangement  of  mechanical  input  member,  and  stability  requirements.  To 
determine  the  absolute  stability  of  an  actuation  system,  the  open-loop 
transfer  functions  may  be  written,  and  Nyquist's  stability  criterion  applied. 
However,  the  basic  requirements  for  stability  are  satisfied  whenever  the 
actuator's  dynamic  stiffness  is  greater  than  its  static  stiffness.  Limit- 
cycle  type  instabilities  can  also  arise  as  a result  of  adverse  distribution 
of  nonlinearities  in  the  system  due  to  wear  of  components,  friction,  and 
erosion  of  the  control  valve. 

The  actuator's  dynamic  stiffness,  which  is  discussed  following 
3.1.11.2,  must  be  higher  than  its  static  stiffness  in  order  to  produce  a 
stable  system  (unless  complex  frequency-dependent  pressure  gain  control  is 
employed).  Overall  stiffness,  is  basically  determined  by  flutter  resis- 
tance requirements  rather  than  actuator  stability  or  dynamic  response 
requirements.  The  spring  rate  of  the  actuator  and  backup  structure  should 
be  as  high  as  possible  but  not  Lo  the  extent  that  weight  penalties  are 
introduced  after  the  flutter  stiffness  requirements  are  met. 

With  the  advert  of  so-called  Irreversible  flight  controls,  the 
philosophy  has  often  been  to  design  the  stiffest  system  possible.  Normally, 
this  has  also  meant  the  highest  possible  static  stiffness,  which  has  often 
resulted  in  a number  of  stability  problems. 

The  proper  approach  to  the  stiffness  design  is  to  first  of  all 
determine  what  is  the  lowest  permissible  static  stiffness  for  the  system  at 
hand.  The  main  considerations  are:  flutter  resistance,  required  surface 

position  resolution,  the  allowable  change  in  gearing  between  the  control 
surface  and  the  pilot's  controls  with  hinge  moment  changes,  and  the  allow- 
able control  surface  deflection  with  no  input  command  which  will  not 
appreciably  change  the  characteristics  of  the  "free"  airplane  response. 

The  automatic  flight  control  systems  are  usually  not  critical  with 
respect  to  loss  of  servopositioning  effectiveness  caused  by  low  static  stiff- 
ness. The  reason  is  that  the  autopilot  systems  normally  have  "q"  programs 
which  lower  the  loop  gains  with  increasing  airspeed.  Low  static  stiffness 
will  merely  add  to  the  intentional  "q"  program  and  may  consequently  be 
compensated  for  during  design  testing. 

If  a particular  surface  actuation  system  requires  a high  static 
stiffness  approaching  or  exceeding  the  dynamic  stiffness  requirement,  then 
either  the  dynamic  stiffness  must  be  increased  or  a mechanical  or  electro- 
hydraulic  compensating  network  must  be  provided. 
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3. 2. 6. A. 2 Motor-pump-aervoactuator  (MPS)  p«cka^e«.  This  la  defined  as  an 
Integrated  aervoactuator  package  which  Incorporates  an  electric  motor 
driving  a hydraulic  pump,  a hydraulic  fluid  reservoir,  a aervoactuator, 
and  necessary  accessories  packaged  in  a single,  self~contained  LRU.  Indi- 
vidual components  within  the  Integrated  package  shall  be  designed  in 
accordance  with  the  applicable  requirements  of  the  corresponding  compon- 
ent specifications.  Essenclal  or  flight  phase  essential  applications 
require  specific  approval  from  the  procuring  activity. 

DISCUSSION 

Such  integrated  packages  have  been  used  for  a number  of  years  for 
surface  control  on  British  aircraft  starting  with  the  Boulton  Paul  delta 
research  aircraft.  Pill  and  P120  the  Saunders  Roe  "Princess,"  the  Vickers 
"Valient,"  the  Hawker  Slddeley  "Vulcan"  the  BAC  "VC-10,"  and  the  Short 
"Belfast."  In  these  applications,  they  are  used  as  the  primary  control 
without  connection  to  the  main  hydraulic  system. 

Development  has  continued  in  this  country  on  the  APFDL  ADP  680-J  program 
where  limited-authority  units  are  being  considered  as  backup  to  the  main 
power  servos  to  provide  survivability  capability.  See  References  49,  65  and 
66. 


3. 2. 6,  A. 3 Actuating  cylinders.  Actuating  cylinders  without  control  valves 
and  feedback  provisions  in  the  same  LRU  shall  be  designed  in  accordance  with 
MIL-C-5503,  except  that  the  life  cycling  requirements  shall  be  modified  to 
reflect  the  specific  usage.  (See  3.1.12) 

DISCUSSION 

MIL-C-5503  has  been  in  use  for  many  years  and  is  still  considered 
adequate  for  nonservoactuator  type  actuating  cylinders,  except  for  the 
endurance  requirements.  Endurance  requirements  (in  MIL-C-5503C)  are  specified 
for  utility  system  cylinders  and  for  flight  control  cylinders,  both  manually 
controlled  (2,000,000  cycles)  and  automatically  controlled  (5,000,000  cycles) 
with  packing  changes  permitted  after  each  500,000  cycles  of  operation. 

Such  requirements  are  strictly  arbitrary  and  do  not  reflect  needs  for 
any  specific  application.  In  many  cases,  especially  large  Class  III  aircraft 
(per  MIL-F-8785)  and  helicopters,  endurance  requirements  may  be  considerably 
greater.  Also,  with  the  use  of  plastic  or  metal  dynamic  seals  (or  combina- 
tions thereof)  much  higher  seal  life  than  is  possible  with  0-rings  is  obtain- 
able. Allowing  changes  at  500,000-cycle  intervals  may  Impose  a burdensome 
maintenance  penalty. 

3 . 2 . 6 .  A . A Force  synchronization  of  multiple  connected  hydraulic  servo- 
actuators  . In  essential  and  flight  phase  essential  flight  control  actuator 
Installations  employing  multiple  connected  servoactuators,  the  actuators 
shall  be  synchronized  as  necessary  to  assure  specified  performance  and 
fatigue  life  as  specified  in  3.1.11.3  in  the  structure  between  actuators 
without  undue  structural  weight  penalties. 
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lUH-ausi'  Ur‘.  nt'od  l or  highoi:  iv  1 labll  it  y la  llu.'  iu.tuatioa  subsystems 
ot  railaln  higl\  pin't  oruiaiu  r aircraft  to  both  maiatatii  control  of  and  prevent 
flat  tor  of  essential  aeruJyuaiiitc  surfaces,  multl\/1e  side-by-slde  arrangements 
of  t hi ee  or  four  ser voac tuators , rather  than  dual-system  tandem  actuators, 
ai  e beiiig  considered.  (Iro.ss  missvnchronlzat  fun  can  lead  either  to  slgnifi- 
caiil  reductions  in  llu.  latlgue  life  of  the  av'tuafors  and  their  support  struc- 
ture or  overdesign  velghl  penalties  to  obtain  the  desired  life, 

'3. 2.(1. A. h Hyciraul  le  i"otuijrs.  Hydiaulle  motors  may  be  u.sed  to  actuate  rela- 
tively low  •dutv-cyt' le , uoncrU.ieal  1 1 ight  eontr<il  surfaces,  such  a.s  wing 
flaps,  but  specific,  approval  irom  the  procuring  activity  mu.st  be  obtained 
before  use  in  higli  duty  cycle  noncrltlcal  appl  icat  ioius  or  In  any  essential 
or  fliclit  phase,  essential  application.  They  shall  be  designed  in  accordance 
with  M1L-M-V997. 


DISCI.SS  ION 

The  requ Ir enienf s that  .specific  approval  must  be  obtained  before,  using 
hydiaulle  motors  in  systems  controlling  bigb  duty  cycle  or  Gs.sential  func- 
tions is  not  Intended  to  prt'hibit  their  use,  but  ratlier,  to  ensure  that  the 
contractor  has  luUy  InvestigHted  their  lapability  to  pel  torm  the  essential 
f unc.ti(.nis  reiialily  and  can  present  substantiating  evidence  for  approval 
before  committing  designs.  One  problem  that  has  been  encountered  in  previous 
designs  has  been  a relallvely  high  rate  of  wear  In  the  gear  reduction  train 
leading  to  excessive  backlash  and  deterioration  In  system  stiffness, 

'3 , 2 . h , ^ K I ec.  i.roiiiec  haul  cal  actual:  ion . I'.lectric  power  may  he  used  to  actuate 
lolaiively  low-duty-cve  le,  uoucrltlc.il  flight  contro]  fu,’’ctlons,  such  as  for 
trim  .anl  in  the  but  .specific  approval  from  the  procuring  activity  must 

be  obtained  betore  use.  in  essenllal  and  I light  phase  essential  applications. 

K 1 ee  u'oniei' bun  i ca  1 acLuatim;  components  shall  be  designed  In  accordance  with 
Mll.--l',-7080,  and  spec.iflc  component  spec  if  ie.atlons  as  .ippllcable,  and  the 
following.  I’ei.  I orraance  requirements  shall  he  adequate  for  intended  applica- 
tion. 

.t,2,u.6  I'ne.  uiiiat  i e a.'  t ua  1 1 on  . rueumat  ic  power  may  lu  used  to  actuate  rela- 
tively 1 ov-dut y-cycl e , noncrltlcal  flight  control  sur  laces,  such  as  wing 
I'aps,  but  speclilc  aiq.n'oval  from  fbe  procuring  acLivity  mirst  be  obtained 
beiore  use  In  essential  and  flight  phase  essential  applications. 

7,2.6.t).l  liigh-pressur e pneumatic  actual  ion.  High-pressure  pneumatic  actua- 
tuui  .'omponent -s  shall  be  designed  In  aeeordance  witli  MIl,-r-856A. 

3..2.('.e.2  l'nej.uiiat_ic  drive  turbines.  Pneumatu  drive  turbines  shall  be 
desig-ued  In  accordance  witli  MIL-D-7b02  when  used  for  FCS  purposes. 


0 IM.l'SS  ION 


Ih-lereiii-e  H2  describes  a unique  lac  pressure  pneumatic,  bigli  torque 
iv’t.ii'v  a.'tuatiou  Lectiiiique  applicable  ti'  aircrift  primary  iH'  standby  flight 


3.2.6. 7 Interfaces  between  actuat  loji  suj^oi  t sttuctun,  and 

control,  surfaces 

3.2.6. 7.1  Control  8ur.face  atops.  Surface  stops  shall  bo  provided  each 
flight  control  surface  to  positively  limit  Its  rnnj,fe  of  motloru  Sto]>s  .shall 
be  located  so  that  wear,  s.lackness,  or  takeup  adjustments  will  not  adverstdv 
affect  the  control  characteristics  of  the.  airplane  because  of  a change  in 
the  range  of  surface  tr.wel.  Kach  .stop  shall  be  able  to  withstand  any  loads 
corresponding  to  the  design  conditions  foi  the  control  system.  I'fliere  pcwi'r 
control  actuators  are  attached  d'rectly  to  the  oontrc.'!  .surface,  .slop'.;  shall 
be  provided  within  the  actuator.  Such  actuators  shall  not  only  be  dtuslgned 
for  maximuJn  impact  loads,  but  for  the  cumulative  fatigue  damage  due  to  load 
cycling  predicted  during  flight  and  due  to  bottoming  during  ground  checkout 
and  taxiing.  Wliere  control  valve  command  Input  stops  are  provided,  the 
actuators  shall  be  designed  for  maximum  impact  stop  .loads,  and  not  for 
fatigue  damage  due  to  bottoming,  except  atj  normally  encountered  with  the 
input  stops  and  feedback  provl.slons  ftmctionlng. 

3.2.6. 7.1.1  Adjustable  stops.  A.1.1  adjustable  stops  shall,  be  pi^sltlvely 
locked  or  safety  wired  in  the  adjusted  position.  Jam  nuts  (plain  or  self- 
locking type)  are  not  considered  adequate  as  locking  devices  for  thi.s  appli- 
cation. 

DISCUSSION 

Control  surface  stops  are  required  to  prevent  exceeding  allowable 
travel  limits  such  as  dictated  by:  aircraft  controllability  requirements, 

prevention  of  damage  to  the  control  surface  or  it.s  primary  surface,  ard/ov 
personnel  safety  considerations  when  the  airplane  is  on  tl\e  ground,  I'Jlierc 
control  valve  conunaud  input  stops  are  provided,  tlie  actuator  must  still  with- 
stand bottoming  loads  in  the  event  of:  mtsrigglng,  failure  of  the  valve 

atops  or  input  links,  failure  or  malfunction  of  feedlvu'k  provi.siotKs,  los.s  of 
hydraulic  pressure  where  other  actuators  or  aerodynamic  forces  can  bottom 
the  actuator,  and  when  the  system  is  depi  essurired  normally  altt'i  ea<'li  flight, 
Wnere  a power  control  actuator  i.s  located  remotely  t rom  tlie  surface,  the 
actuator  may  be  used  as  the  primary  surface  stop,  providing  the  connecting 
linkage  has  an  extremely  remote  failure  probability. 

3. 2. 6. 7. 2 Control  surface,  ground  gust  piotection.  All  flight  control  sur- 
faces shall  have  provl.slons  to  prevent  damage,  from  grciund  wind  loads  as 
specified  in  MIL-A-8865,  However,  no  .separ.ate  provisions  are  required  If  tin' 
damping  characteristics  of  In.st.al  led  flight  control  artuators  suffice  fur 
gust  protection. 

3. 2. 6. 7. 2.1  Control  surface  locks.  Miere  control  surface  locks  arc  used, 
the  lock  system  shall  be  Internal  within  the  airplane.  External  locks  uwy 
be  used  for  helicopter  rotors.  The  locks  shall  either  engage  the  surtaces 
directly  or  lock  tlte  controls  as  near  to  each  surface  as  practicable  and 
shall  be  spring  loaded  to  the  unlocked  position.  Control  surface  locks  shall 
be  designed  to  preclude  attempting  takeoff  with  controls  locked. 
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3 . 2 . 6 . 7 . 2 . 2 Protection  against  Inflight  engaactnent  of  control  surface 
locks . Control  surface  ground  gust  lo  '.ks  and  their  controls  shall  he 
designed  to  preclude  their  becoming  engaged  during  flight • 

J.2.6,7.3  Control  surface  flutter  and  busa  prevention.  All  flight  control 
surface  actuation  systems  controlling  surfaces  which  are  not  dynamically 
balanced  shall  be  effectively  irreversible  or  provided  with  sufficient  damp- 
ing to  prevent  flutter,  busE,  or  other  reiati^d  dynamic  instabilities  for  all 
operating  modes  and  meet  the  requirements  of  MlL-A-8870,  No  active  powered 
compensation  technique  or  tuechanlzatlon  designed  to  artificially  Increase 
effective  stiffness,  damping,  or  natural  frequency  shall  be  used  without 
prior  approval  of  the  procuring  activity. 

niSCUSSION 

The  control  surfaces  of  any  airplane  which  can  be  nosed  over  or  up  by 
high  winds  when  the  control  surface  is  displaced  from  the  neutral  position 
should  be  locked  in  the  neutral  position.  Servo  tab  and  spring  tab  type 
surfaces  need  not  have  locks  or  snubbers  Installed  if  it  can  be  shown  that 
the  connecting  springs  and  linkages  are  sufficient  to  prevent  gust  damage 
to  any  of  the  components. 

Specific  things  which  can  cause  inadvertent  engagement  of  gust  locks 
include  Inadvertent  operation  of  cockpit  control  lever,  relative  deflections 
between  the  lock  control  system  and  the  aircraft,  component  failure,  combat 
damage,  etc. 

See  discussion  following  3.1.11.2,  Stiffness,  for  some  of  the  most 
pertinent  requirements  specified  in  MIL-A-8870.  When  detailed  flutter 
analyses  and  wind  tunnel  tests  are  not  yet  available,  the  following  general 
guidelines  may  be  u.sed: 

For  the  prevention  of  flutter,  each  control  surface  including  its 
actuation  system  should  have  a minimum  natural  rotational  frequency  about 
the  control  surface  hinge  line  of  1.5  times  the  natural  torsional  frequency 
of  the  main  structure  to  which  it  is  attached,  This  should  provide  suffi- 
cient separation  of  natural  frequencies  to  prevent  oscillations  of  the 
control  surface  and  main  surface  or  structure  from  coalescing  and  causing 
flutter. 


For  the  prevention  of  transonic  buzz  instability,  experimental  data 
Indicates  that  the  system  will  be  sufficiently  stiff  if  its  natural  rotational 
frequency 
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niJ/scc  wlicic. 
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speed  ot  sound  in  U/see 
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semielion.t  ol'  liinsed  surhiee  at  tlie  3/4  span  in  feet. 


Transonic  buzz  was  ilrst  encountered  on  Jet  airplanes  and  has  to  be  considered 
un  all  aircraft  which  fly  at  high  subsonic  or  transonic  speeds.  It  is  still 


not  well  understood,  but  experimental  data  taken  at  the  Wright  Air  Develop- 
ment Center  in  the  1950 *£i  led  to  the  development  of  the  equation  noted  above. 


Required  actuation  system  stiffness 


With  the  required  natural  rotational  frequency  identified,  the  required 
actuation  subsystem  spring  rate  (K  ^ ,^)  can  be  determined  from  the  follow- 
ing equation;  ^ ^ 

Kreq'ti  > — L ib/in.  wl>ere 

1-  g 

~ required  natural  rotational  frequency  in  rad/sec. 

1 = inomcnt^of  inertia  of  the  control  surface  about  its  hinge  line 

in  lb-in. - 


t “ nhninuun  actuation  lever  arm  in  indies, 

g = gravitational  constant:  386  in. Asec“, 


Actuation  system  stiffness  detei-minatlon 


lo  meet  the  fail-safe  stability  requirement,  it  is  ususally  necessary  to 
provide  the  required  spring  rate  with  only  one  actuator  per  control  surface 
operating  even  though  multiple  actuators  are  Installed.  The  actual  effective 
spring  rate  of  a flight  control  surface  actuation  subsystem  (Kgff)  is  the 
total  spring  rate  of  the  supporting  structure  from  the  actuator  to  the  hinge 
line  (Ksi),  the  spring  rate  of  the  actuator  (Kact^»  spring  rate  of 

the  surface  structure  (Ks2)  summed  in  series  as  shown  below: 

1 ^ _t_  ^ ! 1 

*^eff{jw)  *^SI  \ctOw)  ^ 


Figure  15D.  Actuator  stiffness  determination 
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Frequency  rel  af 

"^'le  frequency  dependence  of  the  net  stiffness  of  a typical  hydraulic 
flight  control  servoac  tun  tor  is  shovsm  below; 


U> 


K^(ooi 

I)"  \ 


<r' 
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Stall ••  Stitl-i(.‘ss 


a;  . 

' '"'a  ' 


<j  Log  I'r^.aiuciji.v  (radians/sccoiid ) 

F’liinro  16I\  Actualoi  stiffness  vs.  frequency 


St  't'l-  ".i  ifftioKK  is  the  aecuation  sysieni  stiffness  at  zero  frequency. 
Tiie  St  itt'n'  i;:  i i :oouitiaMv  ceist'anl  .at  all  frequencies  up  to  th.e  static 

SI  i‘  tiiess  c'"  n.'.'r  ( ri'r['.!en'' v , , which  can  he  calculated  .a.s  fol. lows'. 


lad/scc.  where 


Ni'-|i)ad  valve  I'.nn.  . . ’/sev/in 


K|.  Ihe  fc'dlsHl.  niiio.  in. /in.  (lallo  of  val\e  ilispl.icenK-nt  to 

pisimi  "111  disi'l.ie.-menl  1. 

et  I eel  i\ r ;ii  e,i  ot  1 he  .1  I nal<  >1  I'isl on,  in. “ . 


Sialic  stitiiies',  K n I.  1-,  [•'■ner  ! Ilv  .’overnetl  In  iliiee  laelors  as  i nllows. 

K .\  ( ( ) ) " ,'\  K j ; K I ) 

K |,  ihe  elic'cfisc  prL'.ssurc  g.iin  psi/i.r.  iiK  ludiiig  actuator  leakage 

and  -.tm.-tural  leedhack  effcvts.  (.Ain  other  pressure  gain 
icdiiciii!'  t’.i  i rs.  sucli  .1'  piessnre  teidb.iek.  must  alsii  he 
iiu  ti  ded.  1 


Dynamic  stiffnesg  is  determined  by  the  solution  of  complete  tr&nofer 
functions,  and  becomes  constant  at  all  frequencies  above  the  frequency- 
independent  dynamic  stiffness  lower  limit,  Wjj  , which  can  be  determined  as 
follows : 


CJ 
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KyRj.-  ( OD  ) 

A K^(0) 


The  frequency-independent  dynamic  stiffness,  K^(  .u»),  of  the  actuator 
is  made  up  of  a number  of  incremental  springs.  For  conventional  linear 
actuators,  the  primary  springs  are  due  to  the  actuator  structure  -tr^’ 

i.e.  : the  cylinder  barrel,  piston  rod,  and  end  caps,  the  bearings  '^Kbrg). 

and  the  fluid  compliance  which  are  also  summed  in  series  as 

follows : 


Ka'*  ) 


K 


fluid 


*^act  str 
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K 


brg 


flu  id 


where. 


.where  P = lluid  bulk  modulus,  psi 
?7  = volumelrie  elYicieney 

A = of  I eel  !vc  area,  in." 

X.  = total  stroke,  in. 


In  calculating  the  fluid  spring,  a realistic  value  f.ar  bulk  modulus 
should  be  used.  Most  available  -data  represents  well-bled  fluid  with  very 
little  entrained  air.  For  normal  situations,  the  value  used  should  be 
reduced  to  80  percent  of  the  ideal;  and,  the  tangent  modulus  (at  the  normal 
actuator  pressure)  rather  than  the  secant  modulus  should  be  used.  If  the 
moving  parts  of  the  actuator  (s)  are  heavy  In  relation  to  the  surface  weight, 
they  must  be  appropriately  accounted  for. 

Stiffness  improvement  methods 

On  stiffness-critical  actuating  systems,  ttie  structural  springs  may 
often  be  more  rigid  than  the  fluid  spring,  and  as  a result,  the  fluid  compli- 
ance may  have  a great  effect  on  tlie  overall  stiffiiess  of  the  system.  However, 
Increasing  fluid  stiffness  by  increasing  actuator  piston  area  introduces 
weight  penalties  in  two  ways.  It  increases  the  size  and  weight  of  the 
actuator,  and  it  increases  the  flow  demand  on  the  hydraulic  system  which,  In 
turn,  can  increase  ttie  size  and  weight  of  i.ydrau.1  Ic  pumps,  fluid  lines, 
reservoirs,  and  other  components,  plus  weight  of  all  structure  which  must 
withstand  actuation  loads.  It  may  be  much  more  ecotiomical  (of  weight)  to 
stiffen  the  structural  .springs  once  the  need  is  recognized. 
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In  situations  where  large  weight  penalties  would  be  incurred  to  meet 
the  frequency  requirements  by  stiffening  existing  structure  and  components, 
other  improvement  methods  such  as  the  following  can  be  considered: 

Utilizing  inactive  actuators.  VJhere  multiple  actuators  ar^  used 
to  satisfy  reliability  requirements  (which  is  the  normal  practice  for 
essential  controls),  they  can  be  designed  to  contribute  stiffness  and  damp- 
ing to  the  system  even  though  hydraulic  S'>nply  pressure  is  lost  through 
hydraulic  system  failure.  This  could  be  accomplished  by  pressure  activated 
v^alving.  VThen  pressure  is  lost,  a spring  loaded  valve  connects  the  input 
and  output  of  the  control  valve  to  a compensator  at  return  line  pressure. 

The  servo  no  longer  supplies  power  to  the  system  hut  does  prov*de  stiffness 
when  the  metering  valve  is  closed  and  damping  when  the  valve  is  open.  This 
concept  adds  some  complexity,  but  the  weight  addition  culd  be  considerably 
less  than  for  stiffening  existing  structure  and  actuators. 

Adding  an  additional  actuator.  The  concept  here  is  to  design  an 
actuation  system  with  one  mere  channel  than  is  required  for  redundancy. 

Thus,  stiffness  may  be  satisfied  with  two  channels  instead  of  one.  For 
example,  in  a surface  control  system  that  requires  three  redundant  channels, 
eacli  channel  must  satisfy  the  maximum  liinge  moment  and  minimum  stiffness  for 
the  situation  when  the  other  two  have  failed.  However,  if  four  channels  are 
used,  the  maximum  hinge  moment  can  be  satisfied  with  two  actuators  instead 
of  one,  and  as  a result,  each  actuator  will  be  exactly  half  the  size  of  those 
in  the  three-channel  design.  With  smaller  actuators,  each  channel  will  be 
more  compliant.  However,  stiffness  now  can  be  satisfied  with  t\/o  parallel 
actuation  channels,  and  the  result  is  a system  that  is  more  rigid  than  the 
three-channel  system.  A .scheme  of  this  type  to  improve  stiffness  may  also 
liave  a weight  advantage. 

Adding  an  independent  damper.  Several  types  can  be  considered. 

One  is  a quasi-servo  damper  channel  similar  to  the  a<  tive  servoactuators . 

When  the  spool  valve  is  closed,  this  damper  provides  an  additional  load 
patli  with  the  stiffness  characteristics  of  the  active  channels.  Wh '■.n  the 
valve  is  open,  in  response  from  the  pilot  oi  AFCS,  the  quasi-servo  acts  as 
a viscous  damper. 

Puro  viscous  fluid  dampers  are  also  used,  and  there  are  several 
linear  or  rotary  types  which  may  be  considered.  They  can  be  installed 
parallel  to  the  actuation  channels  or  at  any  convenient  location  on  a 
surface  such  as  on  the  hinge  line.  They  absorb  energy  from  high-frequency, 

!:i gh-amplitude  vibrations  and  dissipate  it  as  heat.  If  a damped  surface 
experiences  considerable  activity,  throughout  a flight,  the  damper  may 
absorb  energy  faster  than  can  be  radiated  and  create  a high  tem.perature 
probl em. 


Adding  an  actuation  stiffness  compensation  network.  The  basic 
actuator  stiffness  can  be  modified  by  introducing  hydromechanical  or 
electrical  compensating  network.-?  within  the  actuator  loop.  In  the  most 
j'.eneral  case,  this  can  be  done  by  sensing  load  pressure,  passing  this  signal 
through  a bandpass  filter,  and  feeding  this  signal  as  positive  or  negative 
feedback  to  tire  control  valve. 
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3.2.7  Component  design 


3. 2. 7.1  Common  requirements 


3. 2. 7. 1.1  Standardization . Where  practical,  contractor  designed  equipment 
which  has  been  approved  for  use  In  some  models  of  aircraft  shall  also  be 
used  In  later  model  airplanes  If  the  Installation  and  requirements  are 
similar.  Tolerances  shall  be  such  that  Interchange  of  any  LRU  with  any 
other  part  bearing  the  same  part  number  shall  not  require  resetting  A 
parameters  or  readjustment  of  other  components  In  order  to  maintain  overall 
tolerances  and  performance. 

3. 2. 7. 1.2  Interchangeability . Like  assemblies,  subassemblies,  and  replace- 
able parts  shall  meet  the  requliements  of  MIL-I-8500  regardless  of  manufac- 
turer or  supplier.  Items  which  are  not  functionally  interchangeable  shall 
not  be  physically  interchangeable  unless  specifically  approved  by  the  pro- 
curing activity. 

3. 2. 7. 1.3  Selection  of  specif Icatlons  and  standards.  Specifications  and 
standards  for  necessary  commodities  and  services  not  specified  herein  shall 
be  selected  In  accordance  with  MIL-STD-143. 

3. 2. 7. 1.4  Identification  of  product.  Equipment  components,  assemblies, 
and  parts  of  flight  control  systems  shall  be  identified  In  accordance  with 
MIL-STD-130. 

3. 2. 7. 1.5  Inspection  seals.  Corrosion  reslsta.it  metallic  seals  shall  be 
provided  at  all  strategic  locati:ns  to  Indicate  assembly  inspection  and  any 
unauthorized  disassembly. 

3. 2. 7. 1.6  Moisture  pockets.  All  components  shall  avoid  housing  designs 
which  result  in  pockets,  wells,  traps,  and  the  like  into  which  water,  con- 
densed moiscure,  or  other  liquids  can  drain  or  collect.  If  such  designs 
are  unavoidable,  provisions  for  draining  shall  be  incorporated. 

DISCUSSION 

The  standardization  requirements  are  in  keeping  with  standard  Air  Force 
policy  regarding  the  minimization  of  supply  problems  and  cost,  both  for 
equipment  and  for  test  and  qualification.  The  use  of  tried  and  proven  equip- 
ment should  result  in  higher  reliability  than  with  new  designs,  especially 
during  the  early  years  of  operation.  The  use  of  standard  parts  is  also  in 
these  interests. 

All  flight  control  components  must  be  adequately  identified  to  pre- 
clude misuse,  and  strict  adherence  to  inspection  sealing  must  be  held.  The 
consequences  of  maintenance  errors  or  omissions  can  be  catastrophic. 

Close  attention  must  be  given  to  the  avoidance  of  moisture  collections. 
Many  of  the  flight  control  co-nonents  are  exposed  to  subfreezing  temperatures, 
and  can  suffer  serious  perfori.  ace  degradation  due  to  accumulations  of  slush 
and  ice. 
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3.2. 7.2  Mechanical  components.  Mechanical  components  not  covered  by  design 
requirements  specified  elsewhere  within  this  specification  shall  be  designed 
in  accordance  with  applicable  requirements  in;  Government  and  Industry 
.specifications,  in  the  order  of  precedance  specified  in  MIL-STD-143;  in  AFSC 
Design  Handbooks  DH  2-1,  DN  3B1,  Mechanical  Flight  Controls;  and  DH  1-2, 
General  Design  Factors;  and  the  following: 

3. 2. 7. 2.1  Bearings . Flight  control  system  bearings  shall  be  selected  in 
accordance  with  AFSC  Design  Handbook.  DH  2-1,  Chapter  6,  Airframe  Bearings, 
and  the  following. 

3. 2. 7. 2. 1.1  Antifriction  bearings.  Approved  type  ball  bearings  in  accord- 
ance with  MIL-B-6038,  MIL-B-6039,  and  MIL-B-7949  shall  be  used  throughout 
the  flight  control  system,  except  as  indicated  in  the  following  paragraphs. 
Bearing  installation  shall  be  arranged  in  such  a manner  that  failure  of  the 
rollers  or  balls  will  not  result  in  a complete  separation  of  the  control. 
Wliere  direct  a;<lal  application  of  control  forces  to  a bearing  cannot  be 
avoided,  a fail-safe  feature  shall  be  provided. 

3. 2. 7. 2. 1.2  Spherical  bearings.  Where  apace  or  other  design  limitations 
preclude  the  use  of  antifriction  bearings,  spherical-type,  self-lubricating 
plain  bearings  in  accordance  with  MIL-B-81820,  or  spherical  or  special-type 
all-metal  bearing  in  accordance  with  MIL-B-8976  witli  adequate  and  accessi’^le 
provisions  for  lubrication,  may  be  used. 

3.2. 7.2.1. 3 Sintered  bearings.  Sintered  type,  or  oil  impregnated  bearings 
shall  not  be  used  in  those  parts  of  the  flight  .control  systems  which  have 
slow  moving  or  oscillating  motions.  Fast  moving  rotating  applications, 
such  as  in  qualified  motors  and  actuators,  are  permissible.  Bearings  shall 
conform  to  MIL-B-5687. 

3. 2. 7. 2. 2 Controls  and  knobs.  Aircrew  controls  shall  be  shaped  and  located 
per  the  requirements  of  AFSC  Design  Handbook  DH  2-2.  Control  knobs  shall  be 
designed  and  spaced  per  the  requirements  of  AFSC  Design  Handbook  DH  2-2  and 
MIL-K-25049. 

3.2. 7. 2. 3 Dampers . Each  damper  shall  be  completely  defined  by  a detail 
specification.  Control  stick  dampers  shall  be  designed  so  that  they  can 

be  overpowered  by  the  pilot  in  the  event  of  failure  or  malfunction.  Damping 
requirements  for  surface  dampers  shall  be  based  upon  the  anticipated  flutter 
frequency,  but  the  endurance  requirements  shall  be  based  upon  the  same  cri- 
teria established  for  the  surface  control  actuators.  Detail  design  of 
hydraulic  dampers  shall  conform  to  the  applicable  requirements  of  MIL-C-5503. 
All  joints,  connections,  and  bearings  shall  be  designed  to  prevent  the  degree 
of  wear  which  can  cause  unacceptable  freeplay. 

3. 2. 7. 2. 4 Structural  fittings.  All  structural  fittings  used  in  flight 
control  systems  shall  comply  with  the  design  requirements  specified  in  AFSC 
Design  Handbook  DH  1-2,  Design  Note  DN  4B1,  Design  Requirements,  and  where 
applicable,  the  design  considerations  specified  in  Design  Note  DN  4B2, 
Forgings  and  Castings. 
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3. 2. 7. 2. 5 Lubrication.  Where  applicable,  lubrication  fittings  in  accord- 
ance with  MIL-F-3541,  MS15002*-!  and  -2,  or  NAS  516  shall  be  installed  to 
provide  for  lubrication  in  accordance  with  MIL*'STD-838 . NAS  516  fittings 
are  restricted  to  nonstresaed  areas  only. 

DISCUSSION 

Wliere  design  limitations  precluue  use  of  ball  bearings,  the  use  of 
prelubricated,  shielded  roller  or  needle  bearings  such  as  those  of 
MIL-B-3990  and  FF-B-185  will  require  procuring  activity  approval. 

Note  that  general  hydraulic  component  design  requirements  are  speci- 
fied in  3. 2. 6. 5 by  reference  to  MIL-H-8775  and  MIL-H-8890  and  that  general 
high-pressure  pneumatic  compor 'nt  design  requirements  are  specified  in 

3. 2. 6. 7.1  by  reference  to  M'.  -8564. 

3.2. 7.3  Electrical  and  electronic  components.  Electrical  and  electronic 
components  not  covered  by  design  requirements  specified  elsewhere  within 
this  specification  shall  be  designed  in  accordance  with  MIL-E-5400,  MIL-K- 
7080,  MIL-STD-454,  MIL-STD-461,  MIL-W-5088,  MIL-M-7969,  MIL-M-8609.  and 
the  following: 

3. 2. 7. 3.1  Dielectric  strength.  Leakap.e  current  shall  not  exceed  10  milii- 
amps  when  a dielectric  stress  voltage  of  1200  volts,  60  Hz,  is  applied  for 

1 minute  between  Insulated  circuits  and  between  circuits  and  case;  and 
there  shall  be  no  Insulation  breakdown.  When  500  V DC  Is  applied  between 
isolated  circuits  and  tlie  case  jc  connector  shell  for  a period  of  10 
seconds,  the  resistance  shall  be  at  least  50  megohms.  Wlien  a component 
or  connector  has  a lower  design  voltage  limitation,  the  test  shall  be  niri 
at  an  appropriate  lower  voltage  as  defined  by  the  component  spec  i f i cat.  i on . 

3.2. 7.3.2  Microelectronics.  Wlien  used,  microelec  tionic  devices  snail 
conform  to  the  provisions  of  MIL-M-38510. 

3. 2. 7. 3. 3 Burn- In . All  electronic  LRUs  shall  receive  a minimum  of  50  Iniurs 
burn-in  operation  and  testing  prior  to  assembly,  or  after  assembly  if  such 
is  miore  meaningful,  prior  to  installation.  Performance  after  burn-in  slailJ 
be  within  specified  tolerances. 

3. 2. 7. 3. 4 Switches . The  design  of  special  electric/mechaiiical  switclies, 
other  than  toggle  switches,  shall  be  subject  to  the  approval  of  tlie  procur- 
ing activity. 

3 . 2 . 7 . 3 . 5 Thermal  design  of  electrical  and  electronic  e(ii»ipment . Whereve  r 
feasible,  components  shall  be  designed  with  heat-dissipating  efficiency 
adequate  to  allow  simple  conductive,  radiation,  and  free  convection  cooling 
utilizing  the  ambient  beat  sink  to  maintain  the  components  within  their 
permissible  operating  temperacure  limits.  Operation  under  specified  condi- 
tions shall  not  result  in  damage  or  Impairment  of  component  performance. 
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3. 2. 7. 3. 6 Potentiometers . Resistive  variable  voltage  dividers  shall  not 
be  used  in  dynamic  motion  appllcatlous  such  as  sensor  outputs  or  feedback 
output  devices  without  specific  approval  by  the  procuring  agency. 

DISCUSSION 

When  selecting  switches,  the  invulnerability  to  flight  crew  error 
requirements  of  3. 1.9. 6 must  be  considered,  such  as  recognizing  that  the 
selected  positions  of  pujh  button  switches  are  not  apparent. 

The  following  recommendations  should  also  be  considered: 

In  the  design  of  AFCS  components,  the  minimum  feasible  number 
of  parts  should  be  used  and  their  size  and  weight  minimized  consistent  with 
other  requirements  specified. 

Modules  or  subassemblies  should  not  be  smaller  than  that  required 
1.0  perform  a single  I'unctlor.  (As  an  example,  an  amplifier  or  power  supply.) 

Modules  intended  for  field  replacement  should  be  so  constructed 
that  electronic  parts  ot  connector  pins  are  not  exposed  outside  the  frame 
of  the  module. 

Possible  requirements  for  complex  test  equipment  and  test  pro- 
cedures should  be  considered  prior  to  adopting  a modular  design  to  ensure 
that  the  requirements  of  3.1.10.2  can  bo  met. 

Solid  state  devices  are  preferred  over  electron  tubes  and  the 
latter  should  be  used  only  when  they  are  the  only  means  to  meet  the  require- 
ments for  a specific  application. 

The  use  of  microelectronic  technology  should  he  considered  on  the 
design  of  all  systems/equipment.  An  objective  appraisal  of  all  ractors 
concerning  the  system/equipment  design  should  oe  made  with  the  view  of 
maximizing  reliability  and  minimizing  total  cost  of  ownership,  weight,  and 
space  within  the  envelope  of  the  other  performance  parameters  of  the  design. 

The  separation  of  thermal  design  requirements,  specified  in  this  section, 
and  cooling  requirements,  specified  in  Paragraph  3. 2. 9. 3. 3,  is  to  emphasize 
that  both  the  component  design  and  its  installation  must  be  considered  in 
achieving  resistance  to  thermal  failure.  The  preferential  list  of  design 
techniques  to  maintain  heat  rise  within  operable  limits  as  specified  in 
MIL-F-9i*90C  are  listed  here  for  reference 

The  use  of  thermal  characteristics  of  finishes,  induced  draft, 
and  ventilation  by  means  of  baffles,  internal  vents  and  louvers,  and 
packaging  in  heat  dissipating  fluids. 

Air  vents  with  adequate  protection  against  climatic  and  environ- 
mental service  conditions  to  all  exposed  parts. 

Forced  cooling,  if  above  means  are  still  insufficient,  or  if  a 
significant  reduction  in  overall  size,  weight,  or  failure  rate  can  be 
realized.  Fans  or  blowers  employed  shall  operate  from  the  aircraft's  AC 
power  supply. 
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If  heat  dlissipatlon  requirements  are  such  that  the  use  of  heat 
exchangers,  liquid,  air  blast,  or  evaporative  coolants  must  be  resorted  to, 
or  must  be  provided  in  the  aircraft  installation,  prior  approval  of  the 
procuring  activity  is  required. 

3.2.8  Component  fabrication.  The  selection  and  treatment  of  materials 
processing,  and  assembly,  may  be  in  accordance  with  established  contractor 
techniques,  in  lieu  of  the  following  requirements,  upon  approval  by  the 
procuring  activity. 

3. 2. 8.1  Materials . When  Government  specifications  exist  for  the  type 
material  being  used,  the  materials  shall  conform  to  these  specifications. 
Nonspecification  materials  may  be  used  if  it  is  shown  that  they  are  more 
suitable  for  the  purpose  than  specification  materials.  These  matetlals 
shall  have  no  adverse  effect  upon  the  health  of  personnel  when  used  for 
their  intended  purposes.  This  requirement  shall  be  met  for  all  probable 
failure  modes  and  in  the  required  environments. 

3. 2. 8. 1.1  Metals . Metals  used  in  flight  control  system  components  shall 
be  selected  in  accordance  with  the  criteria  and  requirements  specified  in 
AFSC  Design  Handbook  DH  1-2,  Design  Note  DN  7A1,  Metals. 

3. 2. 8. 1.2  Nonmetallic  materials.  Nonmetallic  materials  shall  conform  to 
the  requirements  specified  in  AFSC  Design  Handbook  DH  1-2,  Design  Note 

DN  7A2,  Nonmetals. 

3. 2. 8. 1.3  Electric  wire  and  cable.  Electrical  wire  cables  containing  up 
to  seven  conductors  shall  be  constructed  in  accordance  with  MIL-C-27300 . 
Airframe  wire  bundles  may  be  constructed  in  accordance  with  contractor 
developed  techniques  provided  such  construction  is  approved  by  the  procur- 
ing activity. 

3. 2. 8. 2 Processes 


3. 2. 8. 2.1  Construction  processes.  Heat  treating,  adhesive  bondings, 
welding,  brazing,  soldering,  plating,  drilling,  and  grinding  of  high 
strengtli  .steels,  materials  Inspection,  castings,  forgings,  sandwich 
assemblies,  and  stress  corrosion  factors  used  in  the  fabrication  of 
flight  control  system  components  shall  comply  with  *-he  requirements 
specified  in  AFSC  Design  Handbook  DH  1-2,  Design  Note  DM7B1,  Construction. 

3. 2. 8. 2. 2 Corrosion  protection.  All  flight  control  system  component  parts, 
except  those  inherently  resistant  to  corrosion  in  the  operational  environ- 
ments, shall,  be  finished  per  AFSC  Design  Handbook  DH  1-2,  De.slgn  Note 
DN7B2,  Corrosion. 

3.2. 8.2. 3 Fabrication  of  electrical  and  electronic  components.  The 
applicable  requirements  in  AFSC  Design  Handbook  DH  1-6  Design  Note  DN3H1, 
Electrical/Electronic  Safety  Design  Considerations,  relating  to  the  fabri- 
cation of  electrical  and  electronic  components  shall  be  met. 
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DISCUSSION 


High  quality  materials  and  workmanship  remain  the  key  to  the  fabrica- 
tion of  dependable  components.  Use  of  proven  and  controlled  processes, 
such  as  specified  above,  are  most  lmpv'»rtant  In  reproducible  quality  manu- 
facturing. Special  processes  should  be  clearly  specified  on  the  detail 
drawings  and  the  fabrication  instructions. 

3. 2. 8. 3 Assembling 

3.2. 8.3.1  Mechanical  joining.  Individual  parts  may  be  mechanically  joined 
with  removable  fasteners,  or  by  riveted  or  threaded  connections,  or  by 
qualified  methods  for  permanent  joining. 

3. 2. 8. 3. 1.1  Joining  with  removaMe  fasteners.  All  removable  fasteners 
shall  be  selected  and  used  In  accordance  with  the  appllccble  requirements 
specified  In  AFSC  Design  Handbook  DH  1-2,  Design  Notes  4AI , General  Require- 
ments; 4A3,  Bolts,  Nuts,  and  Washers;  4A4,  Screws;  4A5,  Pins;  and  4A6, 

Ocher  Fasteners  except  as  follows: 

a.  Bolts  smaller  than  1/4  inch  In  diameter  shall  not  be  used  to  make 
single-bolt  connections  or  connections  essential  to  proper  functioning  of 
the  component . 

b.  Each  removable  bolt,  screw,  nut,  pin,  or  other  removable  fastener, 
the  loss  of  which  would  degrade  operation  below  FCS  Operational  Scale  III, 
shall  incorporate  two  separate  locking  or  retention  devices  either  of  which 
must  be  capable  of  preventing  loss  of  the  fastener  by  itself  and  retain  it 
In  its  proper  installation  with  the  other  locking  or  retention  device 
missing,  failed,  or  malfunctioning.  Where  self-retaining  bolts  are  used, 
their  selection  and  installation  shall  be  within  the  limitations  of  MS33602, 
and  only  one  type  shall  be  used  in  any  given  system. 

c.  No  self-locking  nut  may  be  used  on  any  bolt  subject  to  rotation  in 
operation  unless  a nonfriction  locking  devl<'c  is  used  in  addition  to  self- 
locking  devi'-e. 

d.  Lockbolts  listed  in  AFSC  Handbook  DH  1-2,  Design  Note  4A5,  Swaged- 
Collar-Headed  Straight  Pins  and  Cellars,  may  be  used  for  fastening  appli- 
cations not  requiring  removal  on  the  aircraft. 

3. 2. 8. 3. 1.2  Joining  with  rivets.  Rivets  for  all  riveted  joints  shall  be 
selected  and  used  in  accordance  with  the  requirements  specified  In  AFSC 
Design  Handbook  DH  1-2,  Design  Note  4A2,  Rivets. 

3. 2. 8. 3. 1.3  Threaded  joints.  All  threaded  Joints  shall  be  provided  with 
adequate  wrenching  and  holding  provisions  for  assembly  and  disassembly  of 
the  joint  before  and  after  service  use.  Internal  screw  threads  and  external 
rolled  threads  shall  be  in  accordance  with  the  thread  form  requirements 

of  MlL-S-88/9.  Pipe  threads  shall  not  be  used. 

3. 2. 8. 3. 2  Joint  retention.  All  adjoining  parts  shall  be  secured  in  a 
mc’imer  that  will  preclude  loosening  when  subjected  to  internal  or  external 
loads  or  vibration, 
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3. 2. 8. 3. 2.1  Retention  of  tin  ..adc^d  juiiiits . aU  juiuis  wliivh  i ,u  i >■ 

critical  loads  shall  be  positively  locked  Lo  the  .ts.sciiil)  1 cd  posiiiun  i^c.  tliat. 
load  reversal  at  the  threads  is  prevented.  Tlie  use  ol  Jam  Jockiuits  aluuc 
is  not  a positive  locking  means  unless  lockwlrod  or  otlierwtse  restrained. 

3. 2. 8. 3. 2. 2 Retention  of  removable  i'astenerri.  Unless  lesLraineu  1 roin  iiu.iv- 
ing  by  the  attachment  of  adjoining  parts,  all  removable  t'asieneis  shall  be 
positively  locked  in  place.  Self-locking  externally  threaded  iastouers 
shall  not  be  used  except  within  the  limitations  specified  in  11815981,  and 
self-locking  nuts  shall  not  be  used  except  within  the  limitations  specified 
in  MS33588.  All  other  types  shall  incorporate  positive  locking  means  or 

be  safetled  with  cotter  pins  in  accordance  with  M824665,  where  temperature 
and  strength  permit,  or  be  safety  wired.  Cotter  pins  and  safety  wiring 
shall  be  installed  in  accordance  with  MS335AO. 

3. 2. 8. 3. 2. 3 Use  of  retainer  rings.  Retainer  rings  shall  not  be  used  to 
retain  loaded  parts  unless  the  rings  are  positively  confined  by  a means 
other  than  depending  on  internal  pressure  or  external  loads.  Tliey  shall 
not  allow  freeplay  which  could  result  In  structurally  destructive  action 

or  fatigue  failure  of  the  retained  parts  or  i allure  oi  gaskets  or  packings. 
Where  used,  retainer  rings  shall  be  coiimierc.ia  1 ly  available  types  wlu..  h can 
be  installed  and  removed  with  standard  tools. 

DISCUSSION 

It  is  common  practice  to  secure  lasteners  (l.e.,  bolls,  screws,  nuts, 
pins,  etc.)  with  a single  locking  device.  Servu  e experience  has  shown, 
however,  that  due  to  maintenance,  manufacturing,  or  design  eirors,  a single 
locking  device  is  not  adequate  for  critical  applications.  Due  i a number 
of  instances  of  loss  of  fastener  integrity,  It  is  considered  necessary  to 
require  two  separate  locking  devices  on  all  removable  fa  si  eiiei.s  in  my 
installation  in  which  loss  oi  a fastener  could  )eopu  rd  i r.o  lliglii  safelv, 

One  acceptable  practice  i.s  the  use  ui  sc  1 f i eta  1 n uig  bolts  wiih 
cotter-pinned  castellated  nuts  installed  a.s  shown  on  MSl.loOL’.  Other 
fasteners  are  also  acceptable  providing  liiey  meet  tluc  lequlremeiils  in  ilu 
referenc  d AFSC  Design  Handbook  including  reteuiion  ut  iheir  locking  and/i>r 
retention  capabilities  in  all  euv  irorwieutal  condilions  a.ssoc  iat  (.d  with 
their  particular  installation. 

Wiiere  lockbolts  are  used,  it  sliuuJd  be  i iv.cgn  uceo  iiiat  they  .u  e single 
locking  only,  not  close  tolerance,  and  can  ce  uslhI  only  in  joini,-:.  in  \chicb 
clampup  is  allowed. 

Jam  nuts  may  be  used  without  lockwlie  oi  other  retention  iv.  appMca- 
tions  which  serve  cnly  to  preload  tlireaded  joints,  wherein  insjiection 
intervals  are  such  as  to  preclude  unacceptible  latigue  cycles  and  \'heie 
backlash  is  acceptable.  Wliere  they  are  ut . 1 to  pievent  Jc'lnt  ul  scc.nnei  i i.Mi , 
they  must  be  positively  retained. 

3 . 2 . 8 . 3 . 3 Assembly  of  electronic  compoiu-nt  s 

3. 2. 8. 3. 3.1  Electrical  and  electronic  pail  mjjun_l_m^.  I.lei.lronU  parts 
shall  be  mounted  so  that  ease  of  producibll  Ity  and  lua  I nta  inubi  1 i t > Is 
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assured.  Whenever  feasible,  parts  such  as  resistors,  capr.cltcrs,  etc., 
shall  be  mounted  In  an  even,  regular,  row-type  arrangement.  These  parts 
shall  be  mounted  on  a base  so  that  the  leads  do  not  cross  other  leads  or 
connections.  Heavy  electronic  parts  and  assemblies  shall  be  solidly 
mounted  so  that  adverse  affects  when  subjected  to  vibration  and  shock 
will  be  minimized. 

3. 2. 8. 3. 3. 2 Shielding  and  bonding  on  finished  surfaces.  Nonconductlve 
oxides  or  other  nonconductlve  finishes  shall  be  removed  from  the  actual 
contact  area  of  all  surfaces  required  to  act  as  a path  for  electric  current 
and  from  local  areas  to  provide  continuity  of  electrical  shielding  or  bond- 
ing. All  mating  surfaces  shall  be  clean  and  shall  be  carefully  fitted,  as 
necessary,  to  minimize  radio  frequency  Impedance  at  Joints,  seams,  and 
mating  surfaces.  The  resultant  exposed  areas,  after  assembly  at  such 
joints  or  spots,  shall  be  kept  to  a minimum. 

3. 2. 8. 3. 3. 3 Isolation  of  redundant  circuits.  Redundant  circuits  shall  be 
isolated  from  each  other  to  preclude  failure  of  one  portion  of  the  circuit 
from  affecting  any  other  circuit. 

3. 2. 8. 3. 3. A Electrical  connector  Installaclon.  The  number  of  electrical 
connectors  shall  be  kept  to  a minimum  within  the  required  limitations  for 
separation  of  redundant  circuits.  Connectors  shall  be  mounted  to  preclude 
nuisance  warning  indications  and  intermittent  operation  when  subjected  to 
applicable  temperature  differentials,  vibration,  and  shock.  They  shall  be 
polarized  so  that  it  is  impossible  to  mlsmate  them  on  a particular  piece 
of  equipment. 


3. 2. 8. 3. 3. 5 Cleaning  of  electrical  assemblies.  All  electrical  assemblies 
shall  be  thoroughly  cleaned  of  loose,  spattered,  or  excess  solder,  metal 
chips,  or  other  foreign  material  after  assembly.  Burrs  and  sharp  edges 
and  resin  flash  shall  be  removed. 

DISCUSSION 

Isolation  of  redundant  circuits  is  mandatory  to  obtain  the  advantages 
promised  by  using  multiple  signal  paths.  Generally,  redundant  channels  of 
the  same  control  axis  and  electronic  comparison  model  signals  should  not 
utilize  coimnon  or  adjacent! 

Connectors 

Cables  or  cable  runways 

Circuit  cards 

unless  the  design  can  be  shown  by  demonstration  or  analysis  to  meet  the 
appropriate  isolation/separation  requirements. 

A high  percentage  of  electronic  equipment  failures  are  due  to  the 
improper  choice  and/or  assembly  of  electrical  connectors,  and  special 
attention  to  their  selection  and  application  is  Important. 

The  invulnerability  requirements  of  3.1.9  require  wiring  to  he  routed 
with  sufficient  slack  to  prevent  thermal  contraction  or  expansion,  vibration, 
and  flexure  from  causing  damage’ to  the  wire  terminations  and  to  minimize 


noise  pickup.  They  must  also  be  routed  away  from  hot  parts,  such  as  resis- 
tors. Electrical  shielding  generally  must  be  Installed  on  wire  and  cable 
to  minimize  electrostatic  and  magnetic,  coupling. 

3.2.9  Component  Installation 

3. 2. 9.1  Ba.slc  requirements.  Flight  control  system  components  shall  be 
installed  In  compliance  with  the  applicable  requirements  specified  in  ' SC 
Design  Handbook  DH  1-6,  Section  3J,  Flight  Control  Sysrems,  Including  Design 
Note  3JX,  Safety  Design  Check  List,  and  as  specified  herein, 

3. 2. 9. 2 Locating  components.  System  components  shall  be  located  to  provide 
direct  routing  of  the  control  system  signal  and  power  transmission  elements 
(cables,  rods,  lines,  wires,  etc.)  lu  accordance  with  Design  Note  3J1,  Rout- 
ing and  Separation,  only  to  the  extent  that  tlie  components  and  transmission 
elements  arc  not  exposed  to  undue  hazards. 

3. 2. 9. 3 Installation  in  fuel  system  areas.  All  component  installations  in 
fuel  system  areas  sliall  preclude  the  generation  of  sparks  both  during  normal 
operations  and  possible  abnormal  and  failure  conditions. 

3. 2. 9. 4 Electrical  and  electronic  component  installation.  In  addition  to 
the  requirements  specified  in  AfSC  Design  Handbook  DH  1-6,  Section  3J,  the 
applicable  requirements  in  Design  Notes  DN  3H1,  Electrical/Electronic  Safety 
Design  Considerations  and  DN  3H2,  Installation  Safety  Objectives,  shall  be 
met . 

3. 2. 9. 5 Electrical  and  electronic  equipment  cooling.  If  cooling  augmenta- 
tion is  required,  the  installation  of  flight  control  electrical  and  elec- 
tronic equipment  cooling  shall  be  integrated  with  the  cooling  provisions  for 
other  electrical  and  electronic  equipment.  The  requirements  specified  In 
AFSC  Design  Handbook  DH  1-6,  DN  3H1,  Temperature  shall  be  met. 

DISCUSSION 

The  foregoing  requirements  are  in  addition  to  those  specified  elsewhere 
in  the  specification,  primarily  in  3.2.1  through  3,2.6.  The  following  recom- 
mendations regarding  electrical  and  electronic  equipment  cooling  should  also 
be  considered: 

Forced  air  cooling  should  be  used  only  when  natural  cooling  does 
not  provide  sufficient  cooling  or  when  a significant  reduction  in  overall 
size  and  weight  can  be  realized.  Exhaust  and  recirculating  fans,  blowers, 
and  pumps  should  be  driven  by  brushless  motors  operating  from  the  available 
AC  power  sources. 

For  equipment  thermally  designed  for  use  with  external  source 
supplied  cooling  air,  which  may  contain  entrained  water  or  other  contaminants 
detrimental  to  the  equipment,  precautionary  measures  should  be  taken  to 
avoid  direct  impingement  on  internal  parts  and  circuitry  by  channeling  or 
use  of  heat  exchangers.  If  this  is  impractical,  the  water  and  contaminants 
should  be  removed  from  the  cooling  air  by  suitable  removal  devices. 
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OtIuM  I'ooling  iiii-tlKuls  ach  as  llquiii,  fVaiu.i  at  Ivu  i'.!Oi;uUs,  and 
usi.'  i)t  vapor  oyole  i ot  r l>;erant  s should  not  hv'  used,  uxcopt  whou  natural  or 
iorood  air  Okioling  mot  hods  are  unsuitable. 

i , j Kat.trs  I”-' *■_' L’ design  . *A  I ! r i iniiont  s t'i  tliis  spool- 

I'ioat  Ion  shall  lie  sotistiod  by  fiitary  wing  airorail  i xoi’pt  whei  r sperifl- 
(.ally  ir'tod  to  apply  to  other  tvpos  of  alrcratt,  fioi-  oxampli-,  3.J.1.1, 

Pilot  Controls  lor  CTOL  Alrei;tft,  or  wluu-e  modified  by  requirements  denoted 
by  an  asterisk  spee  i f Ic.i  1 1 y for  rotaiv  wing  .ilrctail.  .Special  rotary  wing 
perfc'iuiatu  e and  de.sign  requirements  .it'e  as  liill.ows. 

3 . ,3 . 1 i a 1 i It'S  pel  1 oi  ir.ance  i <-ji^od_iemeui.  *R..i.iiy  wing  airi'raft 

sii.i  1 I meet  the  living  (|uallties  requirements  specified  in  MJ1.-F-83300. 

3 . 3 , )iet  I orimiiu  e-  r lagi  i i_  i ejne  nt_s  . *ihi;  .ittir.ude  and 

beading  hi'l-.l  accurac  i e.s  specified  i i>  the  following  paiagiapli  app.ly  under 
cor, d it  i('ns  oi  fi.xcd  >.  a' 1 1 t-c  t i ve  iiitch  contiol  only.  Allowable  magnitudes 
and  .settling  t Ime.s  ol  pc  r i lu  b.i  t iems  iiuiiu  ed  by  veiiations  in  collective 
pit, 'll  ci'utrol  sh.i  11  bo  as  .■^pe.  ified  by  tbe  ii'ocui.lng  .ntivity. 

o l_l- h.;  K1  v,iw).  'I'loing  t lie  attitudo  hold 

mode,  the  attitude,  in  calm  air,  shall  be  maintained  within  tl  degree  of 
the  roi'eroiice  attitude,  'i'l-.e  dynamic  requirements  of  3.1.3.  t shall  be  met. 

3.J.J.3  i.l’bt  • *"Phc  .luti.imatic  t 1 ighf  cotiiroi 

shall  iiaintaiu  heading  within  41  degree  oi  cmm'.amied  heading  in  forward 
t 1 ijtht  at  .sp'Oeds  .tbove  dO  inots  indleated.  Tne  aiieratt  siuiil  not  overshoot 
the  seleetod  re.id  iug  by  more  ih.an  3.5  degri-o.s  at  speeds  above  sO  knots.  The 
roll  rate  sh.il.l  not  exceed  5.0  degrees  per  sec. 'lul  and  roll  aec.el  er;:  t ion  shall 
not  o.sv'ood  3.0  degroos  |H'I  second  for  Mil  -F-BdiOO  Cl, las  11  and  111  aircraft 
OL  double  tho.se  v. lines  |[.i'  M 1 1, -F-8  3 30ti  Cl.iss  I .iiul  iV  aircr.iit. 

3 . -i  , 3 . 3 i\  1 t 1 L tkk'  hold  . * 

3.  3.3.  3.1  tiaroiiie  t r i i'  .i.likude  sud)  H ii^.it  i.ui . -M'ln-  i oipi  i i cni^ai  L s ol  3. 1.2. 5 
sli.ill  be  met  when  the  tielico|ner  is  outside  the  ground  I'lloct  as  defined 
toi  the  spec  if  i,.'  helicopter. 

3.  i,3.  i,3  Sqahil  k'.,itioii_  .m  ajtitu^de  .^beve  tin  tori  no.  *ilie  cpeiational 
i'.inge  ol  the  al.’.'UiUUe  a.ltitude  i-onttv.'l  mode  shall  he  .'pecilied  in  the 
.ipp  1 i .•ah  1 e svstem  siiei  i 1 i c.it  i .m  . Kilhi.i  this  r.inge.  the  helicopter  .shall 
be  ‘.■ontrolled  to  tlu'  indk’ated  absi'lute  .ilfitude  with  .in  accuracy,  in  calm 
.1  i r while  over  flat  terniiii,  c.t  4-7  feet  tsensi'i  errm'. 

Dl.sacss  ION 

The  .ucuraev  reim  i rement  s I't  t lie  .iltilude  luild  le.'des  .u  e unciuinged 
fr.'iii  tlu'se  specified  in  M 1 L-F-^shOC . i'he  dyn.niiic  rec|u  i l eir.ent  s for  the 
Ikii  eiiiet  r ic  altitude  held  nu>de  art-  discu.-.sed  .liter  3,l.,;.l. 

J.3.3.S  Hi'Ver  liold.  ^For  M 1 L-F--83  3(10  ■Tl.i:...s  11  he  1 i c.-et  i' i s , position  shall 
be  maintained  witli  a dritt  ot  less  tb,.in  30  l\-et  plus  seiiS(ii  error  over  a 
3 minute  poriiHl.  .Mtitntle  shall  be  ma  it.t.i  in-.-d  in  gianmd  el  feet  within  +5 


feet  over  a 5 minute  period.  ITliere  .sp»?clal  mission  requirements  aietate, 
the  contractor  shall  estanlish  further  requi rominit s , subject  to  procurln>’ 
activity  approval. 

3. 3. 2. 5 Vernier  control  for  hovering.  *Vernler  control  .shall  be  provided 
for  accurate  positioning  of  the  aircraft  during  Itoverlng,  unless  control 
commensurate  wit!'  mlnluuim  a.ci'uracy  requirements  can  be  iibtalned  with  t tie 
regular  controls. 

DISCUSSION 

The  hover  hold  and  vernier  control  for  hovering  are  de.signed  to  pro- 
vlda  the  capability  for  accurate  positioning  of  the  aircraft  .and  tii  minimise 
the  pilot's  workload  ft'r  tasks  such  as  precision  placement  of  externally 
carried  cargo.  The  performance  specified  applies  only  to  Mn,-F“83300  Cl, ass 
II  helicopters  and  requirements  may  vary  considerably  for  other  app 1 icat 1 ons , 
or  for  special  mission  requ' '-ements  wltliin  a given  ela.s.s  of  helicopter. 

No  single  value  can  be  given  for  vertical  or  horifamtal  hold  accur.acy 
for  all  aircraft  In  the  hover-hold  mode.  The  requirements  for  prec  l.s  Um 
hover  accuracy  for  placement  of  cargo,  for  example,  posed  for  the  heavy 
lift  helicopter  would  place  unnecessary  restriction  on  the  design  of  the 
FCS  for  aircraft  not  requiring  this  high  degree  of  accur.icy.  Tn  addition, 
requirements  for  .some  Navy  appl  tear  Ic'ns  specify  a hover  requirem(>nt  rel.Ulve 
to  water  velocity,  f('r  sonar  use,  rather  than  fixed  in  space. 

Hover  hold  mode  position  accuracy  is  primarily  dependent  on  accuracy 
of  the  sensors  used  for  re.“:erence.  For  example,  if  doppier  velocity  were 
integrated  to  obtain  position  error,  doppier  drift  would  have  to  be  less 
than  0.10  knot  to  tiold  position  within  twenty  feet  for  two  minutes.  Various 
references  may  be  used  such  a.s  integrated  dopplor  velocity,  inertial  velcu'itv 
reference  or  visual  relcreuoe. 


3. 3. 2. 6 drouriqspeed tK^l_d  . gioumlspeed  hold  Is  a .system  reiju  i remont  , 

provisions  shall  ie  made  to  insert  groundspcod  signals  to  th;i  cyclic  pitch 
and  roll  controls.  After  engagement  of  the  groundspeed  hold  mode,  tlie 
ground  speed  existing  at  the  time  of  engagement  shall  be  held  in  steady 
flight  in  calm  .ilr  within  +3  knots. 

DISCUSFION 

This  requirement  has  been  modified  from  that  specified  in  Mil  ■ I'-oq uoi : 
to  reflect  a more  realistic  system  t>'l  eranct , Tbe  tolerance  of  +i  knots 
is  a])pl  led  to  the  sensed  gioundspeod  at  the  time  k-if  engagement  and  diun  not 
include  any  sensor  tirror.  Reference  to  radar  grovuulspeed  signal  has  heini 
deleted  since  other  signal  source  may  be  used. 

3.3.3  Special  design  t eguirement s* 

3. 3. 3.1  Manual  FCS  design* 

3. 3. 3. 1.1  ■ *The  ooutnil  device  moikn)  an.i  for  ce  re(|ulred 
to  accomplish  stability  and  (auitrol  augmoirta  t ion  shall  not  be  ret  looted  at 


the  aircraft's  cockpit  control.  Force  feedback  shall  be  considered  as  not 
reflected  at  the  controls  If  the  magnitude  Is  less  than  half  the  breakout 
force  of  Che  control  with  lowest  breakout  force.  If  other  control  device 
motions  are  not  to  be  reflected  at  the  cockpit  controls,  the  proposed 
system  shall  be  approved  by  the  procuring  activity.  Full  freedom  of  oper- 
ation of  cockpit  controls  shall  be  possible  at  all  times  stability  aug- 
mentation Is  In  use.  Provisions  shall  be  made  In  cockpit  cor.trol  motions 
so  that  recovery  from  an  augmentation  actuation  hardover  is  possible  under 
all  flight  conditions.  The  cockpit  control  position  may  shift  under  this 
condition. 

DISCUSSION 

It  Is  desirable  Chat  control  force  not  be  fed  back  to  the  pilot's 
controls  from  the  stability  and  control  augmentation  systems  when  he 
normally  controls  the  aircraft  mantially.  Depending  upon  the  mechanization, 
however,  even  with  aeries  actuators,  some  force  may  be  fed  back,  but  it 
should  be  minimized. 

3. 3. 3. 1.2  Feel  augmentation.  *The  pilot  and  copilot  shall  have  the  capa- 
bility of  overriding  the  feel  system  at  all  times.  Upon  failure  of  the 
feel  augmentation  system  the  control  feel  shall  revert  to  a breakout  force 
and  a force  gradient  versus  deflection  required  by  MlL-F-83300. 

DISCUSSION 

The  purpose  of  Che  limitations  on  transients  and  failure  mode  motions 
specified  herein  Is  to  ensure  that  the  short  term  response  of  the  airplane 
does  not  get  out  of  hand  before  the  pilot  can  react.  Values  specified 
herein  for  maximum  acceptable  transients  are  those  which  appear  in  KIL- 
H-8301A.  This  specification  requires  three  seconds  "transient"  time  rather 
thf^  two  seconds  as  for  CTOL  aircraft. 

3.3.3. 2 AFCS  design.  *Integration  of  the  automatic  flight  control  system 
with  the  manual  flight  control  system  shall  not  cause  the  control  feel  to 
depart  from  that  specified  in  MIL-F-83300.  Subsystems  that  trim  control 
forces  to  zero  shall  not  introduce  control  transients  that  degrade  flying 
qualities. 

3 . 3 . 3 . 3 Swashplate  power  actuators* 

3. 3. 3. 3.1  Redundancy . *Swashplate  power  actuators  which  are  essential  to 

flight  of  the  aircraft  shall  be  redundant.  Where  redundant  actuators  are 
used,  the  control  valves  shall  be  redundant. 

3.3. 3.3.2  Jamming.  *The  swashplate  power  actuator  In  aircraft  subject  to 
combat  damage  shell  be  jamproof.  The  threat  shall  he  specified  by  the  pro- 
curing activity. 

3. 3. 3. 3. 3 Frequency  response.  *The  swa.shplate  power  actuator  fre- 
quency response  shall  be  adequate  to  meet  the  flying  qualities  require- 
ments of  MIL-F-83300  when  operated  in  series  with  the  direct  linkage 
and  rotating  controls. 
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3. 3. 3.4  Actuatiun  Htltfwj*.  •!>!»■  s.ti::nfss  th#^  swa«h(  l.it<  !n-rr\'Tt. 
in  conjunction  irtth  rotor  blade  torsional  s*t  J!  fne^s.,  »h.sI1  bv  to 

■inisAze  cfmtrol  loads  and  shar.intt  torsos  gort-r  ito.;  tv  tf.»-  r-.  t.-'? 

DISCLSSKW 

Loss  of  swashplate  contr.ol  in  a hi  1 ; Apt ».  r ;r  ,,  1 I»  , ■ 

tive  control  (thrust)  and  loss  o!  vehuio  attitu^ii-  .a  .o:  r-  1 . f.atast  rv'^hiv- ) . 
Thus,  particular  attention  to  satity  vonsidor.rt  lor.s  l'  neve'.s.iT-  t •irousf.out 
the  design  stage  of  the  suasSsplate  and  its  autu-itors.  lai^h.4si'  is  mvos- 
sary  on  design  to  prevent  «alf  uact  i>ns  ; r.»  .SvurrUig  .irc  to  :n?.ur»-  that 
control  i a;>  he  maintained  in  tt«t  event  a.» t ur.i  t : ’i;  dt'i‘>  Wb>ere  ps-sot 

actuation  of  the  swashplate  is  necessar-.  b»-cjj>.  «:  riij,-  pii.»  ;i:i»  loacs 

the  actuators  and  valves  shall  K-  redundant  i-i.'vvr.t  . ss  r oont : ■ 1 

from  single  ual f unct ion. 

Stiffness  of  the  svashp late  and  its  sipy,  rt-.  is  .titi..*!  ir  i.-t  ii-. 
wing  aircraft  c\n-e  tne  cscillats'r>  1 ins  .ixids  .«ii  t r.«r. silt  t oc  : r -r 
rotor  to  the  svasLplate. 

3. 3. 3. 3 Fatigue  llte  design.  *C.  B^vr.en:  > sJi,».' 1 h^-  ■u>if,:i»  ■ t.  a XLXr.iv.ss. 
safelxfe  of  3600  iwurs,  except  t.'r  seals.  St‘.i  i s sha-'.  ci  Cts:.:ne.;  tv'r  a 
■ iniauM  life  of  1200  hours.  Fatigue  lives  >hal.  be  sd  st  an:  i.jted  be  v'ottpon- 
ent  bench  testing  ar^l  flight  strain  survev,  lives  s.'iall  h«-  deter- 

mined  using  actual  bench  test  strengths  .md  nv.isutiS!;  : light  loads. 

3. 3. 3. 2. 1 Kail  -sat  e . •Ci'ttAc'nents  sub>.t  :.»T>ga>v  \,id-.  c.,  t i>nl> 

be  designed  to  safe-1  lie  but  alsi'  sh.,»l!  he  design.,  t ■.  .i ; ; - . s : e . Kail-sa!» 

design  shal  be  aci.'eved  thtx'ugh  efthet  .»  ledund.int  .,  a.;  p.t  h.  < 

uarning  systec.  or  a ^i^taage  tolerant  tree  design 

3. 3. 3. 3. 2 Display,  •hubsysterts  ttui  . ont  inuous  i ^ disil.u.  or.  ..Aspit  indi- 
cators the  fatigue  loading  of  rotor  oi  dvnan,:.  ...csten  or.jvnerits  sK.ill  he 
redundant  it  an  erroneous  dlspia>  due  r,  suhsoten.  loil-Ate  .Auld  result  in 
advertent  accumulat ion  of  latigue  da&ige. 

DISCUSSION 

Certain  critical  cojsponenis  oi  rotary  ving  aircr..!t  i^i^ht  ..ntr'i  sys- 
tems operate  normally  under  relatively  higii  oscillatory  load  conditions. 

These  components  which  are  eiipo.ced  tv'  fatigue  Iv'ads  sfcil'  . de.signec  to 
be  fail-safe  in  addition  to  being  designed  tv  sa?e-llte.  This  is  ne  essarv 
because  of  the  desire  not  to  "over-design"  the  components  to  keep  weight 
down,  difficulty  of  assessing  the  impact  on  fatigue  of  vehicle  saneuvering 
at  elevated  load  factors  and  the  iMght  safety  Impact  ot  aalfunvtions  of 
these  component s- 

Failureo  within  the  rotating  systems  of  helicopters  are  critical  with 
regard  to  fllt  .'t  safety,  in  fact,  usually  catast rophi .i . Systems  have  been 
devised  to  measure  the  fatigue  loading  in  the  rotor  or  dynamic  system  com- 
ponents and  indicate  to  the  pilot  the  degree  of  loading.  These  systems  permit 
operation  of  the  aircraft  continuously  at  conditions  wherein  loads  generated 
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•=  ; - , ' • • ..  .nrA-ncnl  s subjected  to 

: . . . • • ; : < • • ' ■ ’ - K ,»s  svastspl.ite , swjishplate 

r . ■ ■ . ' • . “ ' Ti--?  t - T c !n  this  aanner . Fatlgu 

,K.-  - • 1 ;~'u.  / s:  .c’--  ;■  • aent  s If  they  are  operated 

ijv  >:n.  . i;  t rt.-  ir.?*nsts  ot  satetv,  since  erroneous 
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4.0  qiALlTY  ASSURANCE 


4 . i General  rc<iulrymgnti> 

4.1.1  Methods  for  deMonatratton  of  ct^Hance.  Flight  control  systea  coa- 
pliance  with  each  of  the  applicable  design  requireavnts  of  this  specifica- 
t ion  or  the  PCS  spec  i f icat  ion  defined  by  4.4.T  shell  be  verified  u.^ing  one 
or  acre  of  the  following  aethods.  Except  where  a specific  aothod  is 
required,  selection  of  the  aethod  of  proof  shall  be  made  by  the  contractor 
subject  to  concurrence  of  tire  procuring  rctlvity. 

DlSa’SSION 

Tiie  basic  philosophy  used  for  setting  coapliance  deaonst  rat  ion  require- 
aents  allows  judgatent  for  selecting  verification  aethods  based  on  the  unique 
needs  of  each  design  requireaent  ai>d  each  procureaent . The  contractor  is 
best  qualified  to  propose  ver i f Icat i in  aelhods  based  on  his  detailed  knov- 
,.edge  of  systea  design.  Cost  effecti'e  and  practical  coapliance  deaonstra- 
tion  procedures  can  only  be  established  by  integrating  this  contractor 
knowledge  with  procuring  activity  desires. 

-.1.1.1  Ar.  1 1 vs  1 s . Coapliance  with  requireaents  in  cases  wl.ere  testing  or 
inspection  Xiuld  be  hazardous  or  otherwise  iapractical  aay  be  verified 
through  analyses.  These  analyses  aay  be  linear  or  nonlinear  and  may  include 
piloted  and  nonpiloted  siaulat f ons,  as  defined  by  the  PCS  development  plan. 

DISCUSSION 

Several  of  the  requirements  included  in  3.0  can  only  be  verified  by 
analysis.  Preliminary  coapliance  demonstration  for  many  more  of  the  require- 
{BcnC  a o i 3 • 0 IMA  y d 1 ac*  be  provided  tiirougii  analysis.  The  PCS  developi.ient  plan 
(4.4.1)  should  ret  loot  the  contractor’s  plans  for  preliminary  and  fin.il  com- 
pliance demon. -it  rat  ion . 

Requirement -s  wtiich  will  likely  be  denx'nst  rated  through  analysis  include’ 
Reliability  and  failure  immunity 
Invulnerabil ity 
Maintalnabil ity 
Operation  in  ; urbulence 

Gain  margins  at  high  frequencies  and  phase  margins  at  all  fre- 
quencies. 

The  following  analyses  will  likely  be  performed  In  a typical  procurement; 

Reliability  and  failure  node  and  effects  analyses.  Reliability  and 
failure  mode  and  analyses  will  normally  be  performed  to  analytically  demon- 
strate that  the  PCS  sstslfied  the  requirements  of  3.1.6  and  3.1.7.  When 
required  by  the  procuring  activity,  the  Reliability  Program  Plan,  defined  by 
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MIL-STD-783,  will  b<>  used  to  perloia  these  analyses.  Reference  83  describes 
Che  Tabular  System  Reliability  inalysls,  (TASRa)  reliability  prediction  ap- 
pro.ich  %d»ich  was  developed  through  a series  of  AFTOL  research  projects.  The 
contractor  should  consider  use  of  TASRA  for  rellabllltv  aPAlyses. 

Vulnerability  analysis.  An  analysis  will  nonkall  y be  pcrfonsed 
to  aialytically  desonstrate  that  the  PCS  meets  the  Invulnerability  require- 
nunts  of  3.1.9.  The  contractor  will  normally  establish  and  submit  to  the 
procuring  activity  a Vu  nerabllity  Analysis  Plan  as  part  of  the  PCS  develop- 
aient  plan  which  defined  analyti<.al  procedures  to  be  useu  for  the  vulnera- 
bility analysis. 

Maintainability  analysis.  An  PCS  laalntulnabil ity  analysis  will 
normally  be  accomplished  as  an  Integral  part  of  the  overall  system  analysis, 
'his  analysis  and  the  associated  Maintainability  Program  Plan,  prepared  In 
iccordance  with  MIL-STD-470,  and  Included  as  part  of  the  PCS  development 
plan,  will  normally  be  used  to  analytically  demonstrate  that  the  requirements 
of  3.1.10  are  satisfied. 


System-safety  analysts.  Hazards  analysis  will  normally  be  accom- 
:'l  isl»ed  as  an  Integral  part  of  the  overall  system  analysis.  These  analyses 
• Md  the  ass(^ciated  System  Safety  Program  Plan,  included  as  part  of  the  PCS 
cevelopnent  plan,  will  normally  analvtically  demonstrate  that  the  requlre- 
-ents  of  such  paragraphs  as  3. 1.3.2.,  3.1.9  and  3.1.10  are  satisfied.  When 
required  by  the  procuring  activity,  MIL-STD-882  will  be  used  to  define  the 
analytical  procedures  to  be  used  for  the  safety  analysis.  When  required  by 
the  procuring  actlvlt; , a System  Safety  Program  Plan  (SSPP)  in  accordance 
vith  MlL-STD-88?  may  be  prepared.  if  a comprehensive  system  safety  program 
.s  not  justified  in  a specific  procurement,  a safety  program  meeting  the 
ir'nitnom  accept  ibie  safety  program  requirements  of  MIL-STD-882  may  be  prepared 
by  ttie  contractor  subject  to  the  approval  of  the  procuring  activity. 

Operation  in  turbulence  analysis.  An  analysis  or  simulation  will 
ni'rnvally  be  pet  formed  to  analytically  demonstrate  that  the  turbulence  pene- 
tration requirements  of  3. 1.3. 7 are  satisfied. 

Stability  Analysis.  A stability  analysis  will  normally  be  required 
to  predict  gain  and  phase  margins  at  frequencies  and  flight  conditions  where 
testing  is  impractical.  C.ain  margins  cannot  be  tested,  for  example,  at  or 
o-ar  1.15  Vl- 

A,  1.1.2  Inspection.  Compliance  with  requirements  associated  with  referenced 
i.mpontnt  specifications,  the  physical  arrangement  of  parts,  or  the  physical 
clatlonship  of  parts  shall  be  verified  by  inspection  of  documentation  or 
nspection  of  the  physical  installation.  Documentation  may  include  documents 
showing  the  qualification  status  of  components  which  have  been  qualified  to 
the  requirements  specifications,  or  drawings  showing  clearances  or  other 
physical  relationships.  The  FCS  development  plan  shall  define  those  require- 
ments to  be  verified  turough  inspection.  Unless  otherwise  specified  in  the 
contract  or  purchase  order,  the  supplier  is  responsible  for  the  performance 
all  inspection  requirements  os  specified  herein.  Except  as  otherwise 
scecUied  in  the  contract  or  order,  the  supplier  may  use  his  own  or  any  other 
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f«cllltlc8  suitable  for  the  performance  of  the  Inspection  requirements 
specified  herein.  The  Government  reserves  the  right  to  perform  any  of  the 
Inspections  set  forth  In  the  specification  where  such  Inspections  are 
des*Md  necessary  to  assure  supplies  and  services  conform  to  prescribed 
requirements. 

DISCUSSION 

Many  of  the  re<iulrcmcnt8  In  Section  3.0  are  that  components  or  sub- 
systems, comply  with  component  or  subsystem  specifications  which  may  be 
sillltary  specifications  or  contractor  prepared  specifications.  Other 
requirements  are  stated  In  terms  of  hyslcal  arrangement  or  physical 
clearances. 

In  the  case  of  demonstration  of  compliance  with  other  specifications, 
tests  may  be  conducted  on  the  ccaponent  or  rubsystem  specifically  for  the 
purpose.  However,  these  tests  are  requirements  of  the  component  or  sub- 
system specification  rather  than  MIL-F-94%.  Compliance  with  MIL-F-9490 
requirements  can  be  verified  by  Inspection  of  the  qual i f Icatlor  status  of 
component  or  subsystem. 


In  the  case  of  requirements  Involving  physical  relationships,  physical 
Inspection  will  provide  the  desired  proof. 

4. I. 1.3  Test.  To  the  maximum  extent  feasible,  compliance  with  the  quantita- 
tive requirements  of  the  FCS  specification  shall  be  demonstrated  by  tests. 
Tests  shall  Include  the  laboratory,  airplane  ground  and  flight  tests  defined 
In  the  FCS  development  plan. 

DISCUSSION 

Verification  by  test  is  the  preferred  metliod  for  demonstrating  compli- 
ance with  requirements.  Due  to  safety  or  cost  considerations,  many  require- 
ments cannot  be  demonstrated  during  flight  testing.  In  some  cases 
analytically  predicted  trends  are  validated  during  flight  at  a critical  or 
representative  set  of  flight  <ondltlons  and  analysis  trends  are  used  to 
extrapolate  these  validated  analysis  trends  to  show  compliance  at  all  flight 
conditions  not  specifically  tested. 

Verification  by  ground  or  operational  mockup  testing  Is  generally 
preferred  where  flight  testing  Is  not  feasible.  However,  as  stated  In  4.1.1 
the  specific  method  to  be  used  for  compliance  demonstration  is  Intended  to 
be  selected  by  the  contractor. 

4.2  Analysis  requirements.  Where  compliance  with  specification  requirements 
through  analytical  predictions  is  used,  the  contractor  shall  define  the  major 
assumptions  and  approximations  used  and  verify  that  the  modeling  end  analysis 
procedures  used  are  conservative.  Verification  shall  normally  require  prior 
use  and  validation  through  comparison  with  flight,  wind  tunnel  or  ground 
testing  data.  In  all  cases  the  contractor  shall  establish  tolerances  on 
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analytical  prcllctionR  uned  to  d»aonatrat«  coapllance  with  specification 
requirement  a.  These  toleranceii  shall  reflect  anticipated  variations  in 
aysteni  or  component  characteristics  such  as: 

0.  Parameters  that  cltanfte  with  temperature,  atnH>spherlc  pressure  and 
other  environmental  factors. 

b.  Parameters  that  change  with  foilnres  or  nuinuf .acturing  tolerances. 

c.  Parameters  that  crltlcallv  affect  system  perforsunce  or  stability. 

d.  Parameters  that  are  not  accurately  known  Uf  thev  are  significant). 

e.  P.ir.imotcrs  that  change  as  a result  of  aging  ot  wear.. 

4.J.1  Piloted  .simulations.  Piloted  simulations  shall  be  perfonsed  during 
KC'S  development.  As  u minimum,  the  following  simulations  shall  be  accom- 
pl  I shed : 


a.  Piloted  simulations  using  ci^mputer  slmulatlia  of  the  PCS  prior  to 
hardware  avalljtbll  It v. 

b.  Piloted  simulations  using  actual  PCS  hardware  prior  to  first 
t I <ghf  . 

4 . 3 Test  requirements. 

4.3.1  General  test  requirements 

4. 3.1. 1 Test  witness.  Refore  cc  .ducting  a required  test,  the  contractor 
shall  notify  an  authorized  procurement  activity  representative.  An  orlenta- 
ti.;n  briefing  on  specific  test  goals  and  procedures  shall  be  given  procuring 
activity  observers  prior  to  any  required  test  sequer  e to  be  monitored  by 

an  observer. 

4. 3.1.2  Acceptance  testa.  Appioprlate  PCS  acceptance  tests  will  be  defined 
by  Che  procurement  detailed  specification. 

4. 3. 1.3  Instrumentation.  Accuracy  jf  instruments  ano  test  equipment  used 
to  control  or  monitor  test  parameters  shall  have  been  verified  since  Its 
last  use  prior  to  Initiation  of  Che  sequence  of  design  verification  tests. 
All  Instruments  and  test  equlpmcd  used  in  conducting  design  verification 
tests  shall: 

a.  Conform  to  laboratory  standards  whose  calibration  Is  traceable  to 
the  prime  standards  at  the  U.  S.  Bureau  of  Standards. 

b.  Be  accurate  to  within  one  third  Che  tolerance  for  the  variable  to 
be  measured. 

c.  Be  suitable  for  mearurlng  the  test  parameter fs) . 

d.  Be  verified  no  less  frequently  than  every  12  months. 
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^.3.1.4  Teat  conJtttonB.  Ihe  «.ont  rac ti't  ahull  vutubi  iah  test 

conditions  wiUch  accuratelv  reprsaent  system  tn-servlce  usaa,e  tl^ruu^;h,'llt 
the  applicable  flight  phasee  and  flight  envelopes  def  I'ud  tn  rtccora.iii  . 
with  MIL-F-8785  or  MIL-K-8331X). 

4.3.2  j^hotatory  tests 

4. 3.2.1  Coaponent  tests..  All  cjmpo.ients  shaP  be  qualified  ti'  the  .ippll 
cable  component  spec  1 f tv  of  Ion  by  Individual  teeits,  by  pi^u'f  of  HlmiUilt\  to 
qualified  comp<<neiit  s whl.'h  are  qualified  under  conditions  appluublc  to  tltc 
specified  operating  condltionn,  by  testing  in  mystew  design  ve  it  1.  .it 
tests,  or  suitable  condi Inat  ions  of  these  metlioua.  Compcinent  qual  i t u .it  i ;■ 
requirements  shall  be  baaed  upon  their  use  in  the  spec  111c  vehicle  and  it - 
associated  enviroiaaent.  Environmental  test  method*,  and  proceduie.s  slu.  ’ 
selected  from  Mll.-STD--4bl , or  MIL-STD~810.  Tlte  contractor  shall  genii.ttc 
additional  metltods  and  procedures  where  Mit-S'ri>-4M  or  Mll-STb-81o  .ire 
Inadequate  for  the  planned  aircraft  usage.  Wear  Hie  3.1.12  sluill  tu 
demonstrated  at  the  component  level  except  wle  re  system  we.ir  life  i>  tnoie 
meaningful  due  to  component  interaction. 

ulsaissioi'i 

Component  test  requirements  are  generally  defined  hs  the  cowpviunt 
specifications  referenced  herein  and  test  mettvods  and  procedures  to  be  used 
are  generally  defined  In  Mil.- STD-8 10,  For  Individual  pri'curement  s these 
requirements  and  methods  nay  be  inadeiiuste  for  either  the  environment  to  he 
experienced  or  for  the  unique  implementation  used.  Special  or  addltlon.il 
te.sts  or  methods  should  be  developed  by  the  contractor  and  included  Ir  the 
PCS  development  plan  or  spec  11 Icat ion.  Among  cimponenl  tests  nornwillv  per- 
formed are; 

lUei*fctric  strength  tests.  Each  circuit  of  electrical  and  elec- 
tronic components  should  he  subjected  to  a test  equivalent  to  the  applic.i- 
tlon  of  a root  mean  square  test  voltage  of  three  times  the  maximum  (hut  not 
less  than  bOO  v.)  surge  d.c.  or  three  times  the  m..iximum  surge  peak  a.c. 
voltage  to  which  the  circuit  will  ne  subjected  under  service  conditions. 

The  test  voltage  should  be  of  commercial  frequency  and  should  be  applied 
between  ungrounded  terminals  and  ground,  and  between  terminals  insulated 
from  each  other,  for  a period  of  one  minute.  Test  should  he  accompl  isb.eJ 
at  normal  ground  barometric  pressure  and  no  breakdown  of  insul.uion  or  .ili 
gap  should  occur.  Circuits  containing  capacitors  or  other  similar  elec- 
tronic parts  which  may  be  subject  to  damage  by  application  of  above  voltages 
should  be  subjected  to  twice  the  surge  peak  operating  voltage  for  t.lie 
specified  period.  If  ttie  muxlmum  peak  operating  voltage  is  greater  tfian 
’00  v. , th**  rms  value  of  the  test  voltage  should  be  1.5  times  greater  than 
the  maximum  peak  operating  voltage.  Electrical  and  electronic  components 
should  also  be  tested  for  resistance  to  air  gap  breakdown  at  the  maximum 
altitude  specified  in  the  altitude  test. 

Electromagnetic  interference  limits.  The  flight  control  avsti-m 
and  components,  both  should  be  assembled  and  arranged  in  a manner  as  sped' 
fled  in  the  system  or  component  specification,  with  Interconnecting  cables 
and  supporting  brackets  representative  of  an  actual  installation.  Provisions 
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flhould  «ldo  b«  for  tnvvrtlng  all  coaponants  with  rvapcct  to  th* 

ground  planr.  nr  pualt toning  In  such  a manner  aa  to  permit  meaaureaanta 
f roai  the  h<ntnm  of  al.  cnaponrnta.  Neaaurement  of  radlat«rd  and  conducted 
Interference  llalta  ahculd  be  made  In  accordance  with  Kn.-STD'461  with  the 
avatem  awitchen,  controla  and  componenta  operated  aa  In  actual  acrvlce. 

Sand  and  duat . Each  comftonent , with  almulated  external  connec- 
tlona  attached,  atiould  be  aubjectetl  to  individual  teata  before  and  after 
expeteure*  Any  duat  film  or  duat  penetrution  ahould  nt't  reault  In  a 
deterioration  of  the  performance  of  the  component. 

Fungus . Equipment  which  haa  parts  of  organ!.'  material  or  other 
materldla  which  may  grow  fungua,  iihould  be  aubjected  to  a fungua  rcalstance 
teat.  The  component  ahould  be  aubjected  to  Individual  teata  before  and 
after  expoaure.  Any  fungua  present  should  not  result  In  a deterioration 
of  the  performance  or  service  life  c*f  the  component. 

Extreme  temperature  tests.  Dynamic  operation  using  expected  high 
and  low  temperature  and  teaperaturc  ahoeV  ahould  be  verified  on  all  compon- 
ents subject  to  binding  or  malfunction  resulting  from: 

(1)  Differential  expansion  or  contraction  ot  mating  parts 

(2)  Deterioration  of  lubricant 

(3)  Deterioration  of  hydraucic  fluid 

(4)  Deterlorat Ion  of  any  type  seal  device 

(5)  Deterioration  of  electrical  part 

(b)  Altered  hydraulic  or  electrical  charactrrlst ics 

(7)  Change  in  performance  functl.on 

The  component  should  be  aubjecced  to  individual  teats  before,  during  and 
after  exposure.  From  these  tests  and  a visual  examination  there  aha^uld  be 
no  evidence  of  damage  or  deterioration  t^hlch  will  prevent  the  component 
from  meeting  its  operational  requirements. 

Humidity  and  corrosion  and  Icing.  Components  subject  to  falluie 
due  to  corrosion,  entrance  of  moisture,  or  formation  of  Ice  ahould  be  given 
humidity  tests  and  salt  spray  tests.  In  addition,  If  Ice  formation  might 
be  detrimental  to  the  equipment,  an  icing  test  should  be  conducted  as  follows: 

(1)  Cool  test  items  to  -12  degrees  C (10.4  degrees  F)  or  lower. 

(2)  Reduce  ambient  air  pressure  to  simulate  40,000  feet  pressure 
altitude  and  maintain  for  at  least  15  minutes. 

(3)  Increase  ambient  sir  pressure  to  ground  level  by  Introducing 
warm  moist  air  at  a temperature  of  at  least  49  degrees  C (120  degrees  F) 
and  a relative  humidity  of  95  (j^5)  percent.  Continue  circulating  warm 
moist  air  until  the  test  item  temperature  is  at  least  5 degrees  C (41  de- 
grees F).  Item  1,  2,  and  3 constitute  one  cycle  of  testing.  Twenty-five 
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cycloa  ahauld  parfora^  to  dctarmlna  ac  oaptaht  1 it  v . Ki  \ i winy  i 

flva  cyclca.  tha  taat  Ua«  thall  ha  f iin.- 1 1 ona II v , hnkad  it  4 1.' 

Hagraa  C (10.4  dagraaa  F)  t««r>aratura.  At  tW  conrluaton  of  tha  2''  . v ,p*. . 
wnd  following  tha  fonctlonal  chack,  tha  aquipnant  ahould  ,*>a  ax.^alnail  t ■« 
avldawca  of  intatnal  n<>tatura.  corrvvalon,  or  othar  dafa^t!'. 

Altltuda.  Elactrlcal  aqulpetanC  and  othrr  * 1 lyiit  .I'lUi.-;  svvt*ii; 
(toaa  which  aay  ha  advaraalv  atfactad  bv  hlgh-a  1 1 it iMla  o>aration  aliounl  bo 
taatad.  A parcantaga  of  tha  total  lifa  trat  ovi  loa,  omn  i>it  ent  with 
vlca  raqulraaanta  of  tha  conponant  . hut  n.'t  lo*»a  ti»ar  2'-  pot- ant,  *>hou!  - t« 
conductad  at  tha  hlgh-a 1 t it uda  condition. 

Vibration,  aho^k  and  aocalarat Ion.  All  aquipaant  «uh)«.t  f. 
fallura  or  laalfunction  dua  tc  x’lhration,  ahoi  k , or  hlitl  ct  1 orat  it^na  olioulii 
ha  tastad. 


Coaihlnad  taaparatura  - altitude  toata  t .'«p -nont  *i  .ind  ?<\Mt<'iah  sub- 
jact  to  laakaga  or  which  may  axparianca  cooliny  proh’anit,  ahmi'.d  hi  Miihto  t • .1 
to  comblnad  tamparatura  -•  altituda  taata. 

Ci^mponant  iiia  taatiAij.  I'omix'npnf  a v.t\ivh  a o Huhjo>.t  ti  wo.i', 
fatigwa,  or  othar  datar  lorat  ion  dua  to  uiiaitr,  should  >a  llfa  tpstoil  under 
raaltatlc  anvlronmantal  condition*  for  a nuoibar  of  cv  le»  repr**»ant .it  i\ e ,>• 
tha  daairad  life  axpactancy  of  tha  componant . In  moat  casaN,  Ilia  tost 
raqulraa^nta  aro  dafinad  in  Uovarnmant  *pac  i t icat  ion* , hut  rrhould  ha 
raviaad  to  reflect  actual  axpacted  ux/rga.  Hydraulic  .'ompi>nantx  shculd  he 
taatad  while  uxin*;  hydraulic  fluid  .*.t  a Ivpic.il  t lee:  onvirimroant  ; luld 
claanllna**  laval . 

Syatam  life  teating.  Tha  aacii.inlcal  pitrttvns  v'f  the  >>>B5'lt:«‘  fiS. 
auch  a«  pulleys,  cable  rods,  torque  tubes,  control  st  ick.s  ct  fc-iieelN,  etc., 
should  he  tested  as  a complete  xvstem.  It  Is  Cv'nsiJvrcd  th.it  ihi  hist  w.iv 
to  do  this  is  in  a ccmplete  system  mockur  In  whlcii  Icids,  rel.iti"i  d i ■ m.  . v 
and  locations,  and  cthar  character iat ic s are  realist !c. 

Mlacel lanaoua  testa.  Equipswent  which  l.s  1 '•ated  so  that  it  is 
subjected  to  rain,  sunshine,  and  sand  and  dust  shall  he  tested  acci'rd  Iny  1 v . 
Components  failing  a service  condition  test  shoulJ  rv.  be  resuhir  od  tor 
teat  without  furnishing  complete  Infonaiition  on  '.he  corrective  ,iv  c ion  taken 
subsequent  to  the  failure.  This  Iriforsuit ion  shield  he  furnished  to  the 
prccurlp.g  activity  or  in  the  test  report,  deperJlng  vpi'n  K'c^tum  ot  tesiiny. 
Depending  upon  the  nature  of  the  failure*  encountered  and  correctix'e  action 
required  and  at  the  option  of  the  procuring  Actlxltv,  ihe  rewi'rV.  or  im'dlfl- 
cations  accomplished  should  also  he  Incorporated  ii.to  the  other  lest  s.imnlts. 
Where  rework  or  modification  may  ho  con-  iderod  us  sutflciint  to  affect  per- 
formance under  the  other  service  condition  tests  already  completed  ut  the 
option  of  the  procuring  activity,  these  testa  should  be  repeated  in  the 
specified  ord-*r. 

Components  to  be  used  under  a particular  category  of  service 
application,  which  have  previously  been  subjected  to  and  accepted  under 
the  requirements  of  a lower,  or  less  severe  category  application,  either  as 
an  individual  component  or  as  a component  of  the  same  or  a different  svstem, 
should  be  subjected  to  a rerun  of  those  service  condition  tests  which 
vary  with  category  of  service  application. 
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>uHttii'nal  atH  ttfftn.  WlnTr  »n«*  '(  the  f Iret 

a n r p i ^rten  tn  » rw*%  ner'e#  ol  aircraft  will  tx't  be  Aval'iable  for  extenalve 
ot  file  Ft  S prior  t<'  f Muht  of  tlwit  •odel , an  operational  wockup 
w»  li  h t um  t tonal  I V , atatt*a;lv  and  dvna«l»allv  dupHraten  the  fllghf  con- 
trol Kvalea  aha  1 I be  conatrinted.  ’or  enaenttal  and  flight  phaae  eatentlal 
flight  k ont  an  accurate  electrical  repreaentat  Ion  ihall  al*o  be  pro- 

viiied,  Frodu.  t Ion  coni  I gura?  l«>n  co*potn'nti*  shall  be  used  for  all  flight 
vontrol  iiv«te»  pirta,  and  tht*  hvdraullc  svaten  shall  be  coapat  Ible  with 
mII  -H-'ivhO  test  requlreaent a.  Trlaarx  aircraft  structure  need  not  be  dupl  c- 
.ated;  fk'wecer.  production  c«int  Igurat  Ion  ai'untlnu  brackets  shall  he  used 
and  shall  be  attaclied  t('  str<^<cture  which  sinulates  actual  mounting  coispll- 
aiu  e . He^hanical  components  >'1  the  FCS  shall  he  duplicated  dimensionally. 
Inertia  and  vi>mpli4nce  ot  t light  contrv>l  surf  aces  shall  he  duplKated  v'r 
a.  .urateiv  simulated.  The  operational  siockup  shall  he  coupled  with  a com- 
puter simulation  ot  aircrett  characterlst Ics  and  external  Inputs  to  the 
! 1 Ight  .ontfi'l  svsic*.  The  tollt'wlng  minimum  testing  shall  be  conducted 
.'«i  t tie  o(>er  at  Ivina  1 skivkut;.  ct  v'thet  .ippr  opr  l.i  t r lest  tacllltv  when  approved 
t'V  the  procuring  actlvltv. 

a.  Iv'wvr  supple  v.iri.itlv’n  lests  t>'  desx'nntrate  s.it  1 st  ictorv  oper.itlon 
. ve:  the  t.inge  v't  allv'wable  varlatli'ns  speilMed  In  t tie  appllc.ible  vontrol 

owi' t spev  if  Iv  .it  tv'ns  reteronced  tn  t . . "v . 

h.  System  fatigue  tests  (where  system  installation  geometry  or  dynamic 
V :;ar  ictet  1st  ,U  s are  critical  to  fatigue  life)  in  .icv'ordance  with  MlL-A-88b7 
li'  densinst  rate  cvimpl  l.ince  with  the  requirements  v't  l.l.ll.).  The  duty  cvcie 
required  stiall  be  established  bv  the  contractor  .is  representative  of  flight 
and  grv'und  usage. 

V.  stability  margin  tests  to  verity  tts'se  requirements  v>f  J.l.l.b 
wtiivli  can  be  verified  bv  test  using  .»n  .ilrcr.it  t simulation  v’r  the  opera- 
t iv'nal  aockup,  but  which  cannot  be  ecv'nv'-talc.al  1 v 'T  s.ifelv  demon.st  rat  ed  In 
t I iglit  . 

d,  Tests  fv'  determine  ttie  eJiects  ot  single  aid  multiple  failures 
on  performance,  safety,  mission  completion  reliability,  and  the  develop- 
ment of  emergency  procedures  l.>  counteract  the  etfeils  of  failures. 

»• , M j seel  laneous  tests  to  denk^nst  rate  IVS  pertormance,  a.nd  compatl- 
nilitv  anx'ng  Ft'S  systems  and  with  interf.iclng  systems, 

t.  System  wear  llte  1,1.  IJ  wtiere  component  wear  life  is  Interactive. 

oiSi  rss  I vis 

The  operational  im'ckup  is  a toi'I  used  tor  validation  of  the  flight 
.v'ntrol  system  design  prior  to  first  flight  and  Is  .also  a useful  tool  in 
t light  control  development.  The  BW’re  nearly  this  tool  functionally 
icserables  the  flight  vehicle  Instal lat  ion,  the  greater  the  confidence  level 
in  the  test  results.  Ideally,  an  airframe  with  a flight  control  system 
inst.il  led  .and  with  aircraft  ‘light  dvnamics  simulated  would  he  the  mock'ip, 
Ise  ot  an  airframe  tor  the  operational  mockup,  such  as  described  In  Refer- 
ence IJ,  Is  becoming  more  popul.yr — espocl.allv  where  the  FCS  ..irframe  inter- 
act ion  is  expected  to  he  complex. 
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Inclusion  or  exclusion  ot  niesns  toe  b imul.il  Ion  \.il  coaliol  burtocc  aoto- 
dynsalc  h^nge  isoa^nts  Is  depenJenf  upon  specific  usage  and  sitould  bo  lust  t- 
f led  by  the  contractor.  Wlioro  slrcv.-ift  struitnial  coitpllama'  Is  simulalod 
In  I leu  of  alrfrano  parts,  verification  should  bo  esi abl  1 sh» d by  the  con- 
tractor through  a detailed  .analysis  »'l  compl  l.iuci  . 

The  specified  tests  lOtiy  bo  pet  formed  Ind  lvldu.il  Iv  or,  wiui.'  feasible, 
a single  teat  may  satisfy  multiple  rei^ulremc'iits.  For  o.x.uiple,  structural 
strength  and  rigidity  Skay  be  verified  during  performance  iresponscl  tost 
and  fatigue  requirements  may  be  verified  as  a p.irt  of  endurance  testing. 

Note  that  the  specified  minimum  tests  nuiy  be  performed  on  alternate  test 
facilities  when  approved.  Separate  c</mponeiu  llfe/loadlng  testing,  for 
example,  may  be  ,iuatlfiable  in  some  cases. 

When  performing  power  supply  variation  tests,  e.u  h i omponenl  should  1h‘ 
tested  individually  or  assembled,  or  both,  into  a svstom  in  a iminner  as 
specified  In  the  component  or  system  speoltic.it  Ion.  Rated  eleoti  lc;’!, 
Iiydraullcs  and  other  required  power  sources  should  be  applied  and  all  cali- 
bration settings  placed  at  maximum  rated  positions.  After  completion  of 
the  warmup  period,  the  power  sources  should  be  varied  and  n'odnlated, 
chrooghout  their  specified  limits.  No  steadv  st.ite  or  iransieiu  modulation 
charges  in  the  power  senuce,  within  peimisslble  limits,  should  cause  .i 
variation  or  modulation  in  the  system's  pert orm.mce  which  may  result  in 
undasirable  or  unsatisfactory  operation.  With  rated  power  applied,  the 
system's  switches,  controls  and  components  should  be  operated  as  in  actual 
service.  Observation  of  the  rated  power  source  should  note  no  variation  or 
modulation  of  the  power  source  beyond  permissablo  operational  limits  vhen 
the  system  is  operated  against  loud  conditions  varying  from  no  hiad  to  full 
load  condttionH. 

Fatigue  tests  may  be  aci'ompl  Islied  hy  cvi- 1 nip,  !r<a>is  on  cooipononi  s i i w.i 
in  one  or  both  hardover  po.sitions  or  in  an  Intermediate  position  such  as 
by  hydraulic  pressure  impulse  testing.  It  should  also  be  noted  that,  for 
fatigue  testing,  the  "appropriate  alternate  teat  facliUy"  could  be  the 
aircraic  f".tigue  test  rig.  See  MlL-A-886o  for  discussion  of  fatigue  scatter 
factors  and  MIL-A-8867  for  fatigue  test  requirements.  Note  that  required 
fatigue  tests  Include  all  linkages,  controls,  etc. 

Subsystem  math  models  used  to  analytically  predict  stability  margins 
for  feedback  systems  should  be  vorefied  on  the  operational  mockup  to  the 
extent  practical.  This  practice  ts  encouraged  since  the  FCS  hardware  such 
as  tensors,  electronics  and  actuators  included  on  the  operational  mockup 
eliminate  error  included  In  the  analytical  predictions  due  to  noul Inearit ies 
and  other  math  modeling  problems  associated  with  these  components.  Wliero 
significant  differences  between  the  analytical  predictions  and  the  opera- 
tional mockup  margins  are  observed  further  frequency  responre  or  other 
tests  should  be  performed  to  identify  the  components  which  are  improperly 
modeled.  Once  these  components  are  identified,  the  corresponding  math 
models  can  be  corrected  and  analytical  margin  predictions  refined. 

One  of  the  major  uses  of  a-  operational  mockup  is  evaluation  of  fail- 
ure effects  within  the  FCS.  The  contractor  should  .ilso  include  perforiminct 
oriented  tests  or  simulations  to  verify  predicted  performance  and  to 
evaluate  system  compatibility. 
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For  essential  and  flight  phase  essential  controls,  the  folla;^ing 
mockup  tests  of  Ah'CS  BIT  and.  failure  reversion  capability  shcnild  be  con- 
sidered: 

Overtemperature  test  of  i\FCS  computers,  panels,  and  sensors  ^ 
evaluate  the  BIT  capability  of  detecting  failures  induced  by  progressive 
overheating. 

Wire  hardnes^s  failures  (shorts  between  wires  and  ground  and  open 
circuits)  to  evaluate  BIT  capability  to  detect  wiring  damage/ failures. 

The  main  objective  of  these  tests  is  not  necessarily  to  make  individual 
components  less  vu.lnerable  to  hazards  or  enemy  action.  Rather,  the  primary 
objective  is  to  ensure  that  true  redundancy  exists  by  verifying  that  indivi- 
dual failures  in  each  channel  (1)  are  detected,  (2)  are  remedied,  and 
(3)  are  not  the  cause  of  multichannel  failures. 

4. 3.2. 3 Safetv-of--filght  teats.  Prior  to  first  flight,  sufficient  testing 
shall  be  accompliahed  to  ensure  that  the  aircraft  is  safe  for  flight.  These 
shall  be  defined  in  the  FCS  development  p3a«  and  shall  include,  but  not  be 
limited  to,  the  following! 

4. 3.2. 3.1  Component  safecy-of-flight  tests.  All  system  components  shall 
successfully  demonstrate  oatlsfactory  performance  and  satisfactory  operation 
under  the  environmental  extremes  expected  in  the  flight  test  program.  Certi- 
fication that  a component  is  safe  for  flight  because  of  prior  qualification 
and  use  on  snother  aircraft  may  be  allowed  provided  that  the  component 
design  is  identical  to  the  previously  qualified  part  in  all  significant 
respects  and  that  ^to  capability  to  o.^ersie  urder  all  conditions  specified 
for  its  new  appH'^ntion  has  been  pr?v*=n, 

4. 3. 2. 3. 2 System  safety-of-f light  tests.  The  complete  system  shall  suc- 
cessfully pass  all  of  the  operational  mockup  tests  specified  in  4. 3.2. 2 
prior  to  first  flight  except  that  only  20  percent  of  the  required  fatigue 
life  demonstration  need  be  completed. 

4.3.1  Aircraft  ;4round  tests.  Prior  to  first  flight  the  following  minimum 
testing  shall  be  performed. 

a.  Gain  margin  tests  to  demonstrate  the  zero  airspeed  6 dB  stability 
margin  requirements  of  3.1. 3,6  for  feedback  systems  depending  on  aero- 
dynamics for  loop  closure  and  to  demonstrate  stability  margins  for  nonaero- 
dynamlc  loops.  Primary  and  secondary  structure  shall  be  excited,  with 
special  attenCion  given  to  areas  where  feedback  sensors  are  located  with 
loop  gains  increased  to  verify  the  zero  airspeed  requirement. 

b.  Functional,  dynamic  and  static  tests  to  demonstrate  that  all  FCS 
equipment  items  are  properly  installed  and  that  steady  state  responses  meet 
FCS  specification  requirements.  These  tests  shall  include  integrated  FCS 
and  test  instrumentation  as  installed  on  the  prototype  airplane.  Compli- 
ance with  the  applicable  residual  oscillation  requirements  of  3. 1.3. 8 shall 
be  demonstrate'!. 
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c.  Electromagnetic  Interference  (EMI)  tests  to  demonstrate  compliance 
with  the  requirements  of  3. 2. 5. 4.1.  Measurement  of  Interference  limits 
shall  be  made  In  accordance  with  MIL~STD'^61  and  MIL**E-60S1 

d.  An  integrity  test  to  insure  soundness  of  components  and  connec- 
tions, adequate  clearances,  and  proper  operation  in  accordance  with  MIL- 
A-8867. 

DISCUSSION 

The  intent  of  parag>.'aph  4. 3. 3. a Is  to  insure  that  no  structural  coup- 
ling exists  between  the  aircraft  structure  and  the  flight  control  system 
(structural  resonance).  This  phenomena  occurs  tfhen  there  is  sufficient  gain 
in  the  flight  control  system  such  that  structural  modes  sensed  by  the  FCS 
sensors  are  reinforced  through  the  loop  closures  in  the  FX:S,  i.e.,  a 180 
degree  phase  lag  exists  at  the  particular  structural  mode  frequency  between 
the  sensor  and  the  flight  control  surface.  This  results  in  a sustained 
oscillation  at  the  structural  frequency.  The  problem  can  be  eliminated  by 
(1 t locating  sense rs  in  the  vehicle  so  as  to  minimize  the  effects  of  either 
structural  mode  slopes  or  accelerations  sensed  by  rate  or  acceleration 
sensors  respectively  in  the  structure  (phase  stabilization),  (2)  designing 
electrical  filters  to  reduce  the  gain  at  these  fTequencles  (gain  stabiliza- 
tion), (3)  reducing  the  total  system  gains,  cr  (4)  various  cunblnatlons  of 
the  above.  Structural  coupling  problems  can  also  arise  due  to  local  insta- 
bilities within  the  actuator  mounting  structure  or  mechanical  linkage,  and 
will  be  discussed  in  closed-loop  limit  cycle  tests.  The  first  two  solutions 
arc  usually  pursued  more  vigorously  than  the  latter.  The  third  approach 
cati  compromise  aerodynamic  performance  that  the  closed-loop  PCS  is  expected 
to  enhance. 

Data  on  structural  characteristics  at  the  various  sensor  locations  are 
usually  obcained  from  flutter  analysis  or  analytical  structural  analysis. 

It  is  very  desirable  to  record  flight  control  sensor  outputs  during  ground 
vibration  or  flutter  tests.  These  characteristics  are  a function  of  the 
structural  stiffness  and  Inertia,  hence  they  vary  with  fuel  loads,  stores, 
and  configuration  changes,  such  as  gear  and  flap  position,  or  wing  sweep. 

In  general,  system  design  considerations  and  ground  test  requirements  for 
elifflluating  structural  resonance  can  be  created  for  two  classes  of  aircraft. 
These  classes  are  large  aircraft  with  structural  mode  frequencies  starting 
in  the  2 - 5 Hz  region,  and  small  aircraft  with  structural  mode  frequencies 
starting  in  the  8 - 12  Hz  region.  Several  examples  of  how  this  problem  has 
been  addressed  in  both  large  and  small  aircraft  will  be  discussed. 

The  intent  of  paragraph  4.3.3.b  is  to  insure  that  the  nonlinearities 
existing  in  the  closed  loop  flight  control  system  do  not  cause  perceptible 
limit  cycle  oscillations  to  occMr  In  flight.  The  phenomena  occurs  when  the 
phase  margin  of  the  flight  control  system  reaches  zero  degrees  (180  degrees 
of  phase  lag  in  the  system),  and  sufficient  threshold  is  available  for  Che 
closed-loop  sysrem  to  react  Co  this  amount  of  phase  lag  between  the  sensors 
and  the  control  surfaces.  The  problem  can  be  alleviated  by  phase  compensa- 
tion in  the  mechanical  and/or  electrical  portions  of  the  systems.  The  pur- 
pose of  introducing  lead  compensation  in  the  system  is  so  chat  a sufficiently 


189 


lilgh  gain  can  be  m<tintaineJ  to  produce  tiiu  desired  " ♦oituance.  Addition- 
ally, statically  unstable  vehicles  require  a minimi  ^ain  level  to  insure 
vehic 1 e stab i 1 i t y . 

Ihe  system  gain  level  and  frequency  of  the  , s,  illations  can  be 
roughlv  estimated  by  performing  a root  locos  or  similar  closed-loop  analysis 
using  both  rigid  and  flexible  inputs  for  the  control  derivatives.  Th's 
analysis  sliould  he  performed  at  the  maximum  closed-loop  total  loop  gain  that 
would  be  realized  in  flight.  The  reason  for  onducting  both  rigid  and  flex- 
ible control  power  analysis  is  tliat  the  actual  control  power  of  the  surface 
will  fall  between  the  two  values  at  the  limit  cycle  frequency.  Once  these 
gain  and  phase  margins  have  been  established,  the  results  should  then  be 
checked  on  the  aircraft  or  equivalent  flight  control  simulate,  (iron  bird), 
using  the  actual  hardware  tliat  the  aircraft  will  use,  witli  the  exception 
of  the  gyroscopes  and  accelerometers,  which  are  u.suallv  easier  to  model 
than  to  "torque"  the  actual  hardware.  These  gala  margin  checks  shoulvi  be 
condui.ted  using  the  results  of  the  ground  vibration  tests  for  the  flexible 
nK?del  of  the  airframe  and  Che  structural  filtering  used  in  the  control  loops. 
The  desirability  of  using  the  structural  data  becomes  more  critical  for  the 
larger  airovaft  because  the  limit  cycle  frequencies  usuallv  occur  in  the 
same  regions  as  structural  frequencies.  Tl>e  gain  and  [base  compensation 
networks  then  become  more  critical  for  the  larger  aircraft  with  lower  fre- 
quency structural  nodes.  Two  general  clashes  of  limit  cycle  can  exist  in 
tlie  flight  control  system,  and  each  can  be  investigated  on  the  aircraft  or 
on  the  iron  bird  simulator.  The  first  is  a low  amplitude  oscillation  that 
occurs  as  a result  of  nonlinearities  about  the  null  position  such  as  hyster- 
esis, It  has  been  the  subject  of  much  documentat Ion  such  as  references  (48) 
lifting  bodies,  (7)  TWEi\D  I,  and  (87)  TWEAD  II.  The  second  limit  cycle 
occurs  as  a result  of  system  saturation  such  as  actuator  rate  limiting  a,;d 
is  extiamely  important  when  investigating  the  characteristics  of  statically 
unsrable  vetiicle,^  and  rite  unique  control  l.aws  required  for  st.ib il  Izat ion 
tiirougliout  the  flight  envelope. 

A typical  plot  c.t  what  can  be  expected  from  these  tests  is  shown  below 
in  K’gure  17b.  The  plot  shows  the  limit  cycle  amplitude  ( is  stabiliza- 
tor deflection;  Kq  A q is  control  system  gain  times  pitch  rate  amplitude) 
and  frequency  plotted  as  a function  of  total  loop  gain  (Kq  is  the  control 
system  gain;  M aerodynamic  gain).  Ideal  Iv,  witli  a linear  control 

system,  no  limit  cycle  would  occur  until  tlte  loop  gain  equalled  the  gain 
necessary  for  critical  stability,  i.e.,  tt'.e  180°  phase  lag  point  on  a fre- 
quency response  plot  or  the  crossing  of  tlie^Ufaxis  on  a root  locus  diagram. 
However,  due  to  nonlinearities  at  li)w  amplitude,  the  phase  lag  is  excessive 
causing  a divergent  oscillation  until  the  amplitude  of  oscillation  reaches 
the  point  where  tlie  effect  of  the  nonl  inearir  ies  is  reduced  and  a stable 
limit  cycle  occurs  as  shown  on  the  lower  portion  of  the  curve.  Increasing 
the  value  of  the  loop  gain  Increases  the  amplitude  of  the  stable  limit  cycle 
and  the  corresponding  frequency  of  oscillation.  As  the  linear  stability 
limit  is  approached,  the  amplitude  of  osclllatinn  rapidly  increases  forming 
a knee  in  the  amplitude  plot  and  the  frequency  falls  off.  The  zero  ampli- 
tude line  and  the  linear  stability  limit  line  represent  the  limiting  case 
for  a completely  linear  system.  For  very  large  inputs  such  as  sharp  stick 
raps  su^’flcient  to  cause  rate  limiting,  system  saturation  will  produce  addi- 
tional phase  lag  in  the  control  loop  causing  large  amplitude,  lower  fre- 
quency, sustained  oscillations  to  occur.  Typically,  the  large  amplitude 
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Iint‘.ir  stiiblllty  limit 


Figure  17D,  Typical  limit  cycle  ground  test  characteristics 


saturation  points,  as  shown  by  the  (LA)  point  in  the  figure,  usually  occur 
at  a significantly  lower  gain  than  the  small  amplitude  divergent  points. 
Although  a larga  amplitude  input  is  required  to  saturate  the  system  at  the 
lower  gain  values,  the  input  magnitude  required  to  saturate  the  system 
gradually  decreases  as  the  gain  increases.  Thus  in  the  gain  range  between 
the  large  amplitude  saturation  point  and  the  small  amplitude  limit  cycle 
divergent  point,  a moderate  size  input  could  be  sufficient  to  saturate  the 
system.  These  large  amplitude,  saturation  type  instabilities  should  be 
taken  into  consideration  when  establishing  flight  boundaries.  This  phe- 
nomena has  been  addressed  in  depth  in  the  (A-7  DFCS)  Digital  Multimode 
Flight  Control  System  program  and  the  results  will  be  included  in  the  Final 
Technical  Report  for  that  program. 

Examples : 

Several  recent  flight  control  programs,  both  developmental  and  produc- 
tion, have  addressed  the  phenomena  of  limit  cycle  and  structural  resonance. 
Problems  encountered  and  solutions  will  be  briefly  touched  upon  in  an  attempt 
to  shed  light  on  understanding  how  to  deal  with  the  problems  successfully. 
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Lifting  Bodies  - X-2AA.  M2F2.  HL-10 


Structural  resonance  and  limit  cycle  testa  were  conducted  on  these 
vehicles  prior  to  first  flight  at  NASA  Flight  Research  Center  (RFC).  Ground 
testing  techniques  and  data  results  are  given  In  reference  48.  A six  db 
margin  tms  used  on  these  tests.  A first  order  aerodynamic  model  was  used 
for  the  limit  cycle  testing.  A rather  interesting  observation  is  the  phase 
lag  contribution  of  various  cov^ponents  of  the  flight  cimtrol  elements  as 
determined  by  recording  vatlous  points  while  conducting  limit  cycle  tests. 
This  data  is  shown  in  figure  IQO. 


lit'it  c>cl»«molitud».  * 


IQ  >0  «>  -IP  St!  tC  ?(■  nt,  ■* 

*q**6,  C*'  '*< 

Figure  18D.  Typical  limit  cycle  ground  test  nharacteristlcs  of  the  pitch  SAS 
of  the  HL-10  lifting  body  at  various  poir^is  within  the  system 


TWeaP  I (F-4C) 

Several  problems  were  encountered  with  both  limit  cycle  and  structural 
resonance  in  flight.  Reference  7 documents  the  problems  that  were  experi- 
enced and  their  solutions.  The  ground  structured  resonance  tests  were  per- 
formed after  structural  resonance  was  encountered  in  flight.  The  gyros  were 
relocated  and  several  modifications  were  made  to  the  structural  filters  in 
the  forward  paths  of  the  CAS.  A six  db  gain  margin  was  the  criteria  that 
was  used  in  the  on-aircraft  ground  tests  (no  iron  bird  was  available).  Once 
the  proper  filter  configuration  was  found » no  further  problems  were  encoun- 
tered. Limit  cycle  problems  were  also  encountered  in  flight.  These  problems 
were  present  throughout  the  program,  and  were  due  to  improper  operation  of 
the  adaptive  pitch  gain  changer.  The  on  aircraft  ground  limit  cycle  tests 
were  conducted  by  simulating  the  gyroscope  and  using  the  first  order  approxi- 
mation for  airframe  dynamics. 

TWeaD  II  - (YF-4C) 

This  was  a high,  fixed  gain  system  that  required  extensive  ground  devel- 
opment and  evaluation  testing  to  alleviate  limit  cycle  and  structural  reso- 
nance problems.  A complete  description  of  tests  that  were  conducted  and  the 
results  are  discussed  in  detail  in  reference  87.  Some  significant  test 
results  are  noted.  A double  notch  filter  was  required  in  the  pitch  axis  to 
allow  a sufficient  fixed  gain  to  be  maintained.  Placing  lead  compensation 
In  the  forward  path  to  eliminate  limit  cycle  allowed  the  maTriimmi  fixed  gain 
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to  be  incraased  by  a factor  of  five.  All  store  loads  flown  were  ground 
tested  for  structural  resonance  and  a six  db  gain  aargin  was  naintalned. 

The  roll  and  yaw  axes  were  cross-coupled,  but  first  order  decoupled  acro- 
dynsaic  trsnafer  functions  were  used  to  conduct  ground  roll  and  yaw  liait 
cycle  tests.  In-flight  liait  cycle  teats  %wre  conducted  in  all  three  axes 
to  validate  the  ground  tests.  These  tests  were  perfonad  to  deteraine  if 
any  lateral-directional  cross-coupling  was  present  that  would  not  show  up 
in  the  decoupled  ground  teats.  Frequency  response  tests  on  the  structural 
filters  showed  that  the  transfer  1 unctions  varied  with  input  aaplitude, 
indicating  non-linearities  in  the  electronics  did  exist  although  no  probleas 
were  encountered  in-flight. 

a-52  Controlled  Configured  Vehicles  (CCV) 

The  extensive  on-aircraft  ground  tests  of  the  Ride  Control  Systea  (RCS) 
and  yaw  daaper  iapleaentation  accoaplished  prior  to  beginning  the  series  of 
B-52  CCV  flight  tests  are  described  in  reference  44.  A block  dlagraa  shov^iag 
the  aechanlzation  of  these  ground  tests  is  presented  in  Figure  19D.  As 
originally  designed,  the  RCS  did  not  satisfy  the  six  db  gain  aargin  require- 
ment on  the  ground,  due  to  excessive  high  frequency  (40  to  50  Hx)  feedback 
gain.  This  problem  was  easily  corrected  by  adding  a high  frequency  attenua- 
tion roll  off  filter  to  the  onboard  analog  computers. 

C-5A 


System  performance  tests  including  sAS  control  characteristic  tests  were 
performt’Ki  on  the  iron  bird.  Ground  vibration  ana  frequency  response  tests 
were  conducted  on  the  aircraft. 

Iron  bird  system  stability  evaluations  resulted  in  detecting  uiucceptable 
low  damping  in  the  alleron-opoiler  system.  Excessive  slop  in  the  aileron 
servo  attach  points  on  the  Iron  bird  and  the  means  of  simulating  surface 
Inertias  were  suspected  of  loading  the  servos  differently  than  actual  air 
loads.  For  these  reasons,  no  modifications  to  the  servo  system  were  incorpor- 
ated prior  to  gaining  experience  on  the  aircraft.  The  rudder  servo  assembly 
also  exhibited  low  damping  characteristics  when  sharp  pedal  commands  were 
given.  This  was  traced  to  lack  of  structural  stiffness  of  the  lower  rudder 
actuator  backup  structure.  The  backup  structure  on  both  the  iron  bird  and 
aircraft  was  stiffened  to  eliminate  the  problem. 

The  only  structural  coupling  problem  encountered  in  the  aircraft  ground 
vibration  tests  was  in  the  pitch  control  system.  This  instability  was  due  to 
a coupling  between  the  inboard  elevator  rotational  frequency,  the  pitch  aug- 
mentation computer  mounting  rack  frequency  and  the  17  Hz  symmetrical  aircraft 
modes.  The  problem  was  corrected  by  stiffening  the  mounting  ruck  and  chang- 
ing the  pitch  SAS  body  bending  filters.  Because  of  test  schedule  conBitmeuts, 
ground  frequency  response  testing  was  not  conducted  on  the  first  production 
ship  until  after  flight  8.  Testing  was  initiated  due  to  detecting  aileron 
servo  system  Instability  during  step  input  commands  of  the  BITE  test  sequence. 
The  frequency  response  data  verified  the  low  damping  exhibited  by  the  aileron 
servos.  The  source  of  the  stability  ,.Toblem  was  found  to  be  positive  struc- 
tural feedback  as  a result  of  a basic  incompatibility  between  follow-up  geo- 
laetry  and  the  structural  deflection  of  the  aileron  hinge  line.  A negative 
structural  feedback  linkage  was  designed  which  solved  the  problem. 
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CALIBRATION 


Flgfure  19D.  B-52D  CCV  ground  test  mechanization 


C-5A  Actlv  Lift  Dlatrlbutlon  Control  Sysfa  (ALDCS) 


System  functional  perfonunca  teats  and  frequency  response  testa  were 
conducted  on  the  Iron  bird.  Aircraft  ground  testing  of  the  ALDCS  prior  to 
first  flight  Included  ground  vibration  tests  and  a coaprehanslve  ground  fre^ 
quency  response  test  program  Including  gain  variations  to  verify  the  six  db 
gain  margin  stability  criteria.  The  prototype  development  program  wan 
highly  duccessfult  resulting  In  no  significant  design  modifications  as  a 
result  of  ground  or  flight  teat. 

F-15 


Structural  Coupling  Effects.  Structural  bending  modes  can  couple 
through  the  CAS  feedback  to  cause  high  frequency  structural  oscillations. 

To  reduce  the  probability  of  this  from  occurring,  special  techniques  were 
used.  There  an  three  vibrational  modes  In  both  the  longitudinal  and  direc- 
tional axes.  These  mode  shapes  vary  slightly  with  fuel  state.  The  effect  of 
first  bending  mode  la  reduced  by  location  of  the  acceleration  and  rate  sensors. 
The  accelerometers  are  located  close  to  Che  vibrational  mode  of  the  first 
bending  mode  and  the  rate  gyros  are  located  at  the  antinode.  The  effects  of 
Che  second  bending  ntodes  were  reduced  by  the  addition  of  second  order  "notch" 
filters  In  the  computation  network.  It  was  assumed  that  the  third  bending 
mode  was  of  a small  enough  magnitude  that  It  would  not  couple  with  the  control 
system,  so  no  compensation  was  added. 

Longitudinal  Structural  Coupling,  During  set  up  of  Iron  bird  testing.  It 
was  discovered  that  the  stabllator  actuators  and  Its  backup  structure  coupled 
with  the  flight  control  system  at  the  actuator's  natural  frequency  (natural 
frequency  is  approximately  27  Herts  which  Is  close  to  one  of  Che  longitudinal 
bending  siodes).  To  eliminate  this  mode,  a 40  radians  per  second  first  order 
lag  was  added  In  series  to  the  notch  filter,  and  the  loop  gain  was  reduced 
by  2/3.  This  eliminated  the  oscillation  but  degraded  the  longitudinal  short 
period  damping  In  the  low  altitude  high  speed  part  of  the  flight  envelope. 
During  Initial  flight  testing,  it  was  decided  that  this  degradation  was 
unacceptable  and  had  to  be  Improved.  A new  structural  filter  was  designed 
that  provides  the  same  or  better  phase  margin  at  the  longitudinal  short  period 
control  f vt?quencles,  and  the  same  or  greater  attenuation  at  the  27  Hz  struc- 
tural mode  frequency,  as  the  original  notch  filter  cascaded  with  the  40  radian 
lag  filter.  The  original  notch  filter  was  conceived  In  anticipation  of  a 
need  to  attenuate  signals  at  the  first  vertical  bending  mode.  Sensor  loca- 
tion, however,  adequately  isolates  system  response  from  tluit  mode,  so  that 
filtering  in  the  8 Hz  region  proved  unnecessary.  This  filter  Is  a double 
lag  with  a break  frequency  of  60  radians  per  second  and  solved  the  structural 
coupling  problem.  Flight  test  results  have  shown  that  this  filter  success- 
fully eliminated  any  structural  oscillations  and  retained  the  original  short 
period  damping  capability  of  the  CAS  system. 

Directional  Structural  Coupling.  During  initial  ground  tests  on  the 
aircraft,  it  was  determined  that  a structural  feedback  vibration  could  be 
excited  at  29. C Hertz  (third  bending  mode)  with  abrupt  Inputs,  like  lowering 
the  gear.  The  structure?  filter  was  modified  to  move  the  notch  to  29  Hertz 
and  to  provide  an  additional  27. radian  per  second  lag.  This  gave  about 
30  db  attenuation  at  this  structural  .:^uency  (29  Hertz)  and  cured  this 
problem. 
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Ah  the  low  altitude  high  speed  part  of  the  flight  envelope  wee  being 
opened  up  it  was  discovered  that  with  the  **new"  filter  the  first  bending 
mode  (7  Herts)  was  excited.  As  a result  of  this,  a third  filter  was 
developed  which  changed  the  notch  froa  29  Ht  to  7 Hs  and  changed  the  lag 
from  27.75  to  59.4  radians  per  second.  This  had  the  effect  of  attentuatlng 
the  signal  by  15  db  at  the  first  bending  SK>de,  while  retaining  10  db  attenu- 
ation <it  the  third  bending  mode.  Neither  of  these  changes  had  any  effect 
on  the  Dutch  roll  damping  mode.  They  have  been  flown  successfully  over 
tne  entire  flight  envelope. 

F-A  SFCS 

Stability  tests  were  conducted  on  the  SFCS  Phase  IIA  secondary  and 
piit\ary  actuator  configuration  installed  in  the  iron  bird.  Limit  cycle 
oscillations  occurred  at  16  which  were  stabilised  by  Increasing  the 
i^Mffness  of  the  fixture  between  the  primary  and  secondary  actuation  as 
veil  as  adding  a stiffner  to  the  bulkhead  behind  the  secondary  actuator. 

This  prompted  similar  testing  on  the  aircraft.  Structural  resonance,  fre- 
quency response,  and  limit  cycling  testing  was  conducted.  No  limit  cycles 
were  detected  in  the  lateral  and  directional  axes  for  loop  gains  up  to 
:.2  db  above  nominal.  The  limit  cycle  amplitude  Increased  to  one  degree 
poak-to-peak  stabilator  deflection  for  Phase  IIA  testing  and  0.3  degree 
tor  Phase  IIB  testing  as  the  pitch  loop  gain  was  increased  to  11  db  above 
nominal . 

During  flight,  a limit  cycle  oscillation  occurred  In  the  pitch  axis 
a*.  23  Hz  during  right  sideslips  in  the  Power  Approach  (PA)  conHguration 
(full  trailing  edge  flaps  with  gear  down)  at  170  knots  and  10  K feet  altitude 
with  the  control  system  in  medium  gain.  A review  of  the  F-4  airframe  dynam- 
o's indicated  that  the  stabilator  and  extended  flaps  both  had  a rotation  mode 
troquency  of  23  Hz.  The  presence  of  the  flap  rotation  mode  of  23  Hs  was 
ti.ought  to  be  significant  by  virtue  of  the  gyro  location  in  the  left  hand 
wing  root  just  forward  of  the  flap.  A notch  filter  centered  at  23  Hs  was 
added  in  the  forward  path  of  the  longitudinal  flight  control  system  that 
oliuiinated  the  problem.  However,  excessive  stabilator  actuator  oscil- 
l.uory  loads  were  observed  during  high  angle-of-attack  maneuvers  that 
resulted  in  moderate  and  heavy  buffet.  A deeper  notch  filter  centered  at 
i Hz  was  Installed  to  eliminate  the  problem. 

V'~A1 


Frequency  response  and  limit  cycle  tests  were  successfully  accomplished 
or  uhe  iron  bird  full  scale  flight  controls  test  stand.  Structural  resonance 
uui  limit  cycle  testing  was  conducted  on  the  aircraft  in  accordance  with  the 
pnn  edures  described  in  NASA  TN  D-6867  (Reference  48).  Adequate  stability 
margins  were  demonstrated  for  the  pitch  and  yaw  axes.  The  pitch  axis  wao 
st.thlllzed  with  a 9.5  Hz  notch  filter  and  reducing  the  bandwidth  of  the 
secondary  actuator  from  100  to  50  radlans/sec.  The  yaw  avis,  per  se,  did 
noi  require  any  structural  filter.  Howevsr,  an  8 Hz  notch  filter  was  Incor- 
porated to  reduce  coupling  between  the  8.0  Hz  lateral  fuselage  bending  mode 
and  yaw  rate  feedback  that  tended  to  reduce  damping.  In  the  roll  axis, 
grcnind  structural  resonance  tests  indicated  an  adequate  gain  margin.  However, 
continuing  analysis  of  structural  dynaralcs/control  system  compatibility  checks, 
usMtg  flutter  analysis  with  active  controls  represented  predicted  that  a 
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pottntlal  Inarabllity  axiatad  undar  caitain  flight  conditions  due  to  an 
interaction  between  the  approxlautely  7 Ha  wing  bending  wnaent  and  the  roll 
augaantation  ayateti.  Furtharmoret  the  liait  cycle  gain  aargin  was  Judged 
insufficient,  particularly  with  vingtip  aisallea  off,  considering  that  the 
large  aeroelaatic  correction  for  the  roll  control  derivative  eight  not  be 
fully  applicable.  For  these  reaaona,  a cautioua  in-flight  evaluation  was 
decided  upon.  At  0.8  Mach,  15  K altitude,  with  the  20  Ha  notch  filter  and 
the  roll  gain  aet  at  30Z  of  nonsal,  very  lightly  daaped  wlngtip  oscillations 
at  7 Ha  occurred.  The  roll  notch  filter  was  changed  froa  20  Ha  to  a stag- 
gered 7 Ha/8.5  Ha  notch,  and  a 20  Ha  lead  tcra  was  resK>ved  froa  the  feed- 
back coapensation.  The  latter,  in  effect  was  equivalent  to  adding  a 20  Ha 
lag  filter  and  was  intended  to  stabiliae  the  19  Ha  aode.  The  aodified 
filters  gave  fully  srr.isiactory  reaulta.  The  subject  of  Interaction  bet%^en 
the  control  lugaentation  aystea  and  airfraae  dynaaics  on  the  YF-17  is 
addressed  in  Reference  86. 

A sunsnary  of  the  flight  control  system  ground  test  'experience  discussed 
in  previous  paragraphs  is  presented  in  Table  IID. 

As  can  be  seen,  various  ground  testing  methods  can  be  used  for  evaluat- 
ing stability  margins.  Test  methods  should  be  proposed  by  the  contractor 
based  on  the  chaci  ctei ist.'cs  uf  the  system.  The  important  consideration  is 
that  the  requirements  for  (ground  stability  and  l^mit  cycles  are  satisfied, 
and  that  flight  safety  i..  assured  for  the  fcllowli^ij  flight  tests.  There 
flight  tests  are,  of  course,  the  logical  means  for  demonstrating  performance. 
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FLIGHT  CONTROL  SYSTEM  GROUND  TEST  EXPERIENCE 
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No  iron  bird  siaulator  available.  No  intlight 
problems.  See  text  and  Ref  48. 

No  iron  bird  available.  See  text  and  Ref  7 
for  in-flight  problesis. 

No  iron  bird  available.  See  text  and  Ref  E7 
for  in-flight  probleas. 

See  text  for  pitch  Halt  cycle  problem  detected 
after  flight  8. 
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In-flight,  Inadequate  pltib  damping  and  7 Hz 
structural  coupling  in  roi.  See  text. 

In-flight  pitch  axis  limit  cycle  in  PA  aode 
and  high  angle  of  attack.  Sec  text. 

In-flight  Halt  cycle  in  roll  axis.  See  text 
and  Re  f 86 . 

No  iron  bird  available.  No  in-flight  probleas. 
See  teXk  and  Ref  44. 
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Iron  Bird  SiaulaCor 
Test  Aircraft 

Both  Iron  bird  and  Test  Aircraft 


4.3.4  riliht  Plight  t»st«  thall  b*  conducted,  ai  defined  in  the 

PCS  development  plan,  to  demonstrate  compliance  with  requirements  tdtere 
compliance  cannot  reasonably  be  demonstrated  by  other  testa  or  analyses. 

The  design  and  teat  condition  guidelines  tabulated  in  MtL'F-B783  shall  bf 
considered  in  establishing  the  flight  teat  plan.  Plight  test  data  shall 
be  used  to  verify  the  analytical  trends  predicted  and  shall  be  compared 

to  the  performance  and  design  requirements  of  the  PCS  specification.  Con^ 
parable  data  trends  shall  be  required  for  verification  where  anlytlcal 
data  is  used  to  extend  or  extrapolate  flight  teat  data  to  show  compliance. 

In  iddition,  teats  shall  be  conducted  to  assure  that  the  flight  control 
system,  in  all  operational  states,  does  not  violate  the  flutter  requlrestent s 
of  MlL-A-8870. 

DISCUSSION 

Table  XV  of  H1L-P'8785B  gives  general  guidelines  for  flight  test 
conditions  to  be  used  for  evaluation  of  handling  qualities.  Plight  tests 
for  demonstration  of  compliance  with  this  specification  01IL-P'?490)  will 
be  concurrent  with  those  required  by  MlL-P'-878^.  Teat  data  requi resent h 
aay  be  identical  or  tandem. 

Cain  margins  are  required  by  3. 1.3. 6 for  airspeeds  from  0 to  I.IS  V{ . 
During  flight  teat  gain  margin  predictions  should  be  verified  for  all 
flight  speeds  up  to  in  critical  flight  configurations.  Verification 
will  normally  require  comparable  trends  between  flight  test  data  and  analy> 
tlcal  predictions.  Complete  flight  test  checks  of  gain  margins  would  be 
costly  and  are  not  recommended.  Sufficient  gain  margin  flight  test  data 
points  should  be  generated  to  validate  the  analytical  trends  used  to  predict 
margins. 

4.4  Documentation.  PCS  data  submittal  and  approval  requirements  for  each 
specific  model  aircraft  shall  be  in  accurdencc  with  the  contract  requirements. 
The  data  shall  be  furnished  in  accordance  with  appropriate  line  items  of 

the  Contractor  Data  R q<'lrements  List  (DD  Pom  1423).  Typical  information 
and  data  items  are  listed  in  this  section. 

4.4.1  Flight  control  system  development  plan.  A flight  control  system 
development  plan  shall  be  prepared  by  the  contractor  for  approval  by  the 
procuring  activity.  This  plan  shall  be  revised  and  updated  at  Intervals  as 
spcclfiec  by  the  procuring  activity  until  it  la  mutually  agreed  that  r 
further  revision  is  requirad.  The  plan  shall  includa  a minimun  of: 

a.  A detailed  milestone  chart  showing  the  interrelationship  between 
phases  of  dcve'opment  work  to  be  accomplished.  Design  reviews  shall  be 
Identified  and  scheduled  and  an  outline  of  the  progressive  design  verifica- 
tion process  to  be  used  by  the  contractor  shall  be  Included.  Starting  and 
completion  data  for  all  work  items  and  due  dates  for  all  reports  shall  be 
Identified. 

b.  A PCS  synthesis  and  analysis  plan  describing  the  general  approach 
and  analytical  procedures  to  be  used.  Analyses  planned  to  generate  require- 
ments for  the  PCS  specification  shall  be  described. 


199 


c.  A vt  *‘lf icution  plan  defining  the  awena  aelected  by  the  contractor 
for  verifying  that  tiu  deeign  aMcta  each  of  the  requirements  of  the  PCS 
specification.  Verification  aaians  shall  be  apecifically  correlated  with 
each  specification  requlreiaent . 

d.  Flight  safety,  reliability,  ouilntalnability  and  vulnerability 
analysis  plans  to  Include  a description  of  the  ^:nalytical  or  other  means 
selected  hy  the  contractor  for  design  ve.'lf Icatlon  in  these  areas. 

e.  A functional  ouckup  test  plan.  Including  the  test  procedures  to  be 
used  and  a listing  of  requirements  to  be  satisfied  by  each  test. 

f.  A ground  test  plan  and  ground  teat  procedures  defining  the  ground 
tests  and  functional  checka  to  be  performed  prioi  to  flight. 

g.  A flight  test  plan  and  detailed  flight  test  procedures.  Each 
procedure  shall  be  correlated  witn  one  or  more  requirements  of  the  PCS 
jtpcclf  lea  t ion. 

DISCUSSION 

This  series  of  plans  Is  meant  to  make  available  the  contractor's  plan- 
ning and  Intended  development  process  to  the  procuring  cctivity  early  in 
the  development.  The  verification  plan  is  a key  means  whereby  the  con- 
tractor interfaces  with  the  procurvng  agency.  As  a part  of  the  verification 
plan,  a description  and  tabulation  of  means  to  be  used  to  verify  each  of  the 
requireuents  of  the  flight  control  systeiu  specification  of  4.4.2  must  be 
submitted.  Table  HID  is  a tabulation  of  typical  verification  -itesns. 

The  verification  means  of  Table  HID  indicate  the  typical  means  to  be 
used  to  verify  requirements.  The  contractor  will  be  required  to  prepare 
detail  descriptions  of  the  planned  verification  for  eae;  requirement  con- 
tained within  the  FCS  specification  of  4.4.2.  In  different  piocurements, 
different  verification  means  may  be  used  to  verify  the  same  requirement. 

Only  through  interaction  between  the  contractor  and  the  procuring  activity 
can  practical  verification  means  He  established  for  uniqut  requirements  In 
each  procu'ement.  By  updating  the  FCS  development  plan  and  the  included 
verification  plan  at  intervals,  thi'^;  interaction  should  occur  and  practical 
verification  means  should  be  identified. 

'.4.2  Flight  control  system  specif tc >tion.  The  contractor  shall  prepare 
a flight  control  system  petrification  incorporating: 

a.  Applicable  general  system,  implementation,  and  test  requirements 
of  this  specification. 

b.  Special  requirements  of  the  procurement  air  vehicle  detail  speci- 
fication. 


c.  Special  requirements  determined  by  the  contractor,  as  required  by 
the  general  specif IcaC 'on. 

A preliminary  FCS  specification  shall  be  prepared  within  90  days  of  contract 
award  and  progressively  u,<daied  as  requirements  are  finalized. 
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TABtJ  I IID 

TYPICM.  VEKiFICATION  MEANS 


REQUIREMENT 

ANALYSIS 

SIMULATION 

INSPECTION 

BENCH 

TEST 

CiROUND 

TEST 

1 ILKJHI 
1 TEST 

3.1. 1 

X 

X 

X 

3.1.2 

X 

X 

X 

3.IJ 

X 

X 

X 

X 

X 

3.1.4 

X 

X 

X 

X 

X 

3.1.5 

X 

X 

X 

X 

X 

3.1.6 

X 

X 

3.1.7 

X 

3.1.8 

X 

X 

X 

X 

3.1.9 

X 

X 

X 

X i 

1 

y 

3.1.10 

X 

X 

X 

X 

3.1.11 

X 

X 

X 

3.2.1 

X 

X 

X 

X 

X 

3.2.2 

X 

X 

X 

3.2.3 

X 

X 

X 

3.2,4 

X 

X 

X 

X 

3.2.5 

X 

X 

X 

X 

X 

3.2.6 

X 

X 

X 

X 

3.2.7 

X 

X 

3.2.8 

X 

3.2.9 

X 

3.3 

X 

X 

X 

X 

X 

X 

A. A. 3 Design  and  test  data  regulreiaents.  If  applicable  design  data  are 
available  the  contractor  shall,  in  lieu  of  preparing  new  desip  a data,  use 
these  available  data  supplemented  by  sufficient  inforniation  to  substantiate 
their  applicability. 

A. A. 3.1  FCS  analysis  report.  A report  describing  FCS  analysis  shall  be 
prepared  using  an  outline  prepared  by  the  contractor,  subject  to  procuring 
activity  approval.  This  report  shall  be  initially  prepared  immediately 
following  the  preliminary  FCS  analysis  and  synthesis  and  periodically 
updated  throughout  the  development  period.  The  final  update  shall  include 
as  a minimum: 

a.  Design  requirements  and  crltei la  used  during  the  FCS  analysis 
and  synthesi-4. 

b.  Block  diagrams  of  the  FCS.  These  diagrams  shall  Include  transfer 
or  describlnij  functions  and  indicate  normal  control  paths,  redundancy, 
manual  overrides,  emergency  provisions,  location  and  type  of  sensors  and 
control  device  used. 
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c.  A general  description  of  the  F'^S.  The  various  modes  of  operation 
shall  be  described  and  the  theory  of  operati<^n  discussed. 

d.  Discussions  of  unusual  or  difficult  design  features  and  problems. 

e.  A description  of  the  stability  and  performance  of  the  FCS  and  a 
comparison  of  system  characteristics  with  the  requirements  of  the  ^'CS  speci- 
fication. Data  shall  be  presented  for  both  linear,  small  perturbation 
analyses  and  for  nonlinear  simulations  or  analyses  vhich  consider  nonlln- 
earitles  such  as  actuator  rate,  electronic  amplifier  saturation,  and 
actuator  position  limits.  Where  analytical  predictions  are  used  to  satisfy 
specification  requirements,  the  assumptions,  analytical  approximations  and 
the  tolerances  placed  on  these  analytical  predictions  by  the  contractor 
shall  be  documented  and  justified. 

f.  Results  of  the  FCS  flight  safety,  reliability,  maintainability  and 
vulnerability  analyses.  The  reliability  analysis  r;  suits  shall  include  a 
detailed  listing  of  possible  fallu  modes.  The  approach  and  souices  of 
data  used  shall  be  discussed  and  the  results  compared  to  and  correlated 
with  requirements  of  the  FCS  specification.  Analytical  methods  used  shall 
be  documented  and  justified  by  the  contractor. 

g.  A general  control  system  layout  or  series  of  layouts  showing 
control  surfaces,  actuation  systems,  feel  systems,  pilot's  controls  and 
control  panel  organization.  Means  of  providing  redundancy  and  emergency 
provisions  shall  be  Illustrated.  Layouts  shall  -‘nclude  wiring  schematics 
for  all  electrical  and  electronic  port..ons  of  the  FCS  and  attendant  elec- 
trical, hydraulic,  and  pneumatic  power  Inputs  to  the  FCS. 

h.  A description  of  piloted  simulations  performed,  as  required  by 
4.2.1.  Where  piloted  simulation  data  Is  used  to  verify  specification 
requirements,  the  simulator  and  flight  configurations  simulated  shall  be 
described  and  the  data  compared  to  and  correlated  with  the  requirements  of 
the  FCS  specification. 

i.  Mathematical  models  of  the  FCS,  the  unaugmented  airplane  and  other 
data  required  to  allow  the  procuring  activity  to  independently  simulate  the 
FCS  at  any  point  during  or  following  the  air.-'raft  development  process. 
Mathematical  models,  block  diagrams,  stability  and  performance  date  and 
layouts  shall  be  updated  following  flight  tests  to  incorporate  modifica- 
tions made  d.  ring  testing. 

4.4. 3.2  FCS  qualification  and  inspection  report.  The  contractor  shall 
document  results  of  inspections  used  to  demonstrate  compliance  with  require- 
ments of  the  FCS  specification.  Where  inspection  of  component  qualification 
status  documentation  is  used  to  verify  compliance  with  the  FCS  specifica- 
tion, the  contractor  prepared  component  specification  shall  be  submitted  as 
a par:  of  the  FCS  inspection  report. 

4. 4. 3. 3 FCS  test  report.  A report  describing  and  correlating  tests  per- 
formed and  dat-a  generated  to  verify  requirements  of  the  FCS  specifications 
shall  be  prepared  by  the  contractor.  This  report  may  be  prepared  in 
volumes  and  shall  include  a minimum  of; 
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a.  A detailed  description  of  the  operational  mockup  including  part 
nunbers  and  the  test  conditions  under  which  data  was  generated  and  a com- 
parison of  the  FCS  specification.  Inclusion  or  exclusion  of  control  sur- 
face aerodynamic  hinge  moments,  simulation  of  aircraft  structural 
compliance  In  lieu  of  airframe  parts  or  use  of  other  approximations  in 
operational  mockup  construction  shall  be  Justified.  All  discrepancies  or 
corrective  actions  arising  from  operational  mockup  testing  shall  be 
reported. 


b.  A description  of  the  airplane  ground  tests  performed  and  data 
generated  and  a discussion  of  any  system  adjustments  or  modifications 
required  to  satisfy  requirements  of  the  FCS  specification. 

c.  A comparison  of  flight  test  data  with  requirements  of  the  FCS 
specification  and  a description  of  the  airplane  configurations  and  flight 
conditions  tested.  Modifications  to  the  FCS  made  during  the  flight  test 
phase  to  meet  FCS  specification  requirements  shall  be  documented  and  Justi- 
fied. 

DISCUSSION 

The  documentation  defined  in  the  preceeding  paragraphs  is  considered 
required  for  a major  production  aircraft  development.  For  other  programs, 
such  as  advanced  developments,  prototype  aircraft,  experimental  aircraft 
and  off-the-shelf  aircraft  buys,  the  procuring  activity  may  waive  much  of 
this  documentation  or  may  be  satisfied  with  alternate  pertinent  documenta- 
tion. 


In  procurements  requiring  development  of  an  automatic  landing  system, 
extensive  documentation  is  normally  required  describing  the  all  weather 
landing  system.  A typical  set  of  documentation  includes: 

All  weather  landing  system  description.  The  system  description 
should  describe  in  detail  the  all  weather  landing  system  with  particular 
emphasis  on  the  redundancy  and  monitoring  techniques  used.  Interface  with 
other  airplane  systems  should  be  discussed. 

All  weather  landing  failure  analysis.  The  failure  analysis  docu- 
mentation should: 

(1)  State  all  significant  failure  effects  anvi  the  probability 
of  a hazard  due  to  each  and  combinations  of  these  failures. 

(2)  List  all  predictable  failures  and  errors  which  can  result  in 
significant  effects. 

(3)  Describe  precautions  taken  to  reduce  probability  of  serious 
failures;  e.g.,  separation  of  wiring  bundles  and  power  from  different  gener- 
ator sources. 

(4)  Record  estimates  of  the  probability  of  a failure  or  combina- 
tion of  failures  to  show  that  this  probability  is  acceptable  in  terms  of  the 
probability  of  a hazard  due  to  the  failure.  Sources  and  criteria  used  as  a 
basis  for  the  estimates  of  these  probabilities  should  bo  indicated.  The 
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frequency  and  scope  of  system  checks  required  and  effects  of  frequency  of 
check  on  probabilities  of  undetected  and  dormant  Tallures  should  be  pre- 
sented. 


(5)  State  the  procedures  taken  to  ensure  high  reliability  of 
maintenance  action  where  this  action  Is  a critical  feature  In  the  safety 
assessment. 

(6)  Describe  the  method  used  to  evaluate  crew  response  required 
to  counteract  failures.  Delay  times  to  recognition  of  a warning  or  fail- 
ure and  to  subsequent  corrective  action  should  be  Included. 

All  weather  landing  performance  analysis.  The  all  weather  land- 
ing system  simulation  should  be  described.  A detailed  account:  of  the  cal- 
culation of  normal  dispersion  should  be  included,  together  wl>:h  an  assessment 
of  the  risk  of  a hazard  due  to  use  of  the  system.  In  addition,  results  of 
the  flight  test  documentation  program,  showing  the  normal  performance  under 
failure-free  conditions  and  the  effects  of  significant  failures  should  be 
Included.  Correlation  of  flight  test  results  to  simulator  ar.d/or  analysis 
results  should  be  discussed. 

All  weather  landing  safety  assessment . The  safety  assessment 
documentation  should  summarize  procedures  developed  and  analyses  completed 
which  show  that  the  system  meets  all  safety  requirements.  It  should  also 
show  that  the  stated  procedures  are  suitable  for  use  by  crews  of  represent- 
ative ability  and  should  ensure  safe  operation  under  normal  and  failure 
conditions. 

All  weather  landing  operational  and  maintenance  procedures.  All 
operational  and  maintenance  procedures  required  to  attain  the  specified 
performance  and  safety  should  be  detailed.  The  operational  procedures  should 
include  the  nature  and  frequency  of  any  inflight  tests  of  the  system,  and 
the  corrective  action  required  following  a failure  or  warning.  The  mainten- 
ance procedures  documentation  should  identify  the  nature  and  frequency  of 
periodic  tests  of  the  Individual  units  of  the  system  to  detect  dormant  fail- 
ures or  out-of-tolerance  components  within  the  system.  Specific  instructions 
for  maintenance  or  troubleshooting  to  clear  faults  should  be  given  to  ensure 
that  the  airplane  is  dispatched  with  a safe  operational  system.  The  main- 
tenance procedures  should  also  specify  the  type  and  calibration  status  of 
equipment  to  be  used  by  maintenance  crews. 
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5.0  PREPARATION  FOR  DELIVERY 


5.1  Packaging  requirement a.  In  the  event  of  direct  purchases  by  cr  ship- 
ments to  the  Government,  the  packaging  shall  be  In  accordance  with  the 
contract  or  the  approved  component  or  subsystem  specification,  as  appli- 
cable. Components  shall  be  delivered  complete,  tested,  and  ready  for 
Installation. 

6.0  NOTES 

6.1  Intended  use.  This  Is  a general  requirements  specification  applicable 
to  flight  control  systems  and  la  based  upon  service  experience  to  date. 
Deviations  to  the  requirements  of  the  specification  may  be  granted  following 
presentation  and  approval  of  substantiating  data. 

6.2  Procedure  for  requesting  deviations.  The  reou^ rements  of  MIL-STD-480 
shall  be  met.  Substantiating  data  shall  be  In  Lhe  form  of  test,  simulation 
or  analytical  data  generated  by  the  contractor  during  design  tradeoffs. 

6.3  Reordered  equipment  or  second  source  procurement . Where  models  or 
drawings  of  components  of  systems  ate  furnished  by  the  procuring  activity 
on  a contract  to  facilitate  Interchangeable  construction,  or  where  procure- 
ment is  for  equipment  to  provide  Interchangeable  use  with  equipment 
previously  procured,  and  the  requirements  for  interchangeability  contradict 
the  current  requirements  of  one  or  move  MIL  specifications,  the  contract 
requirements  for  Interchangeability  govern. 

6.4  User’s  guide.  A background  Information  and  user’s  guide,  AFlDL-TR-yA- 
116,  provides  explanations  of  and  justification  for  the  requirements  of 
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general  specification. 

6.5 

Abbreviations 

AFCS 

Automatic  Flight  Control  System 

BIT 

Built-in -Test 

CDRL 

Contractual  Data  Requirements  List 

C.G. 

Center  of  Gravity 

CTOL 

Conventional  Takeoff  and  Landing 

EFCS 

Electrical  Flight  Control  System 

EMI 

Electromagnetic  Interference 

EMP 

Electromagnetic  Pulse 

FCS 

Flight  Control  System 

g 

Gravitational  Constant 

LRU 

Line  Replaceable  Unit 

MFCS 

Manual  Flight  Control  System 

MPS 

Motor-Pump-Servoactuator  Package 

TAS 

True  Airspeed 

VOR 

Very  High  Frequency  Omnidirectional  Range 

V/STOL 

Vertical/ Short  Takeoff  and  Landing 

6.6 

Definitions 

Airspeeds.  Airspeeds  referenced  within  this  specification  are  as 
defined  In  either  MIL-F-8785  or  MIL-A-8860.  MIL-  F-8785  defines  airspeeds 
associated  with  flying  qualities  and  MIL-A-8860  defines  airspeeds  related 
to  loading  and  flutter. 
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Alert  height.  A height  (100  feet  or  less  above  the  highest  elevation 
in  the  touchdown  zone),  based  upon  the  characteristics  of  the  aircraft  and 
the  particular  airborne  Category  III  system  above  which  a Category  III 
approach  would  be  discontinued  and  a missed  approach  execute.d  if  a failure 
occurred  In  one  of  the  required  redundant  operational  systems  In  the  air- 
craft or  In  the  ground  equipment. 

All  weather  landing  system.  An  all  weather  landing  system  Includes 
specifically  all  the  elements  of  airborne  equipment  and  more  generally 
includes  the  ground-based  equipment  necessary  for  completion  of  the  all 
weather  landing.  All  weather  landings  comprise  the  operations  and  proced- 
ures required  to  conduct  approaches  and  landings  during  Category  II  and  III 
visibility  conditions  defined  by  the  International  Civil  Aviation  Organi- 
zation. 

Automatic  flight  control  system.  See  1.2. 1.2 

Automatic  landing  system.  A landing  system  which  provides  automatic 
flight  control  to  touchdown  or  to  touchdown  and  beyond. 

Built-in  test  (BIT).  Integral  onboard  testing  devices  which  enable 
rapid  isolation  on  the  ground  of  a faulty  Line  Replaceable  Unit  (LRU) 

(either  manual  or  automatic),  without  removing  the  LRU  from  the  aircraft. 
Usually  a warning  of  malfunction  is  given  by  an  external  device  on  the  LRU. 

Category  I operations.  An  instrument  approach  procedure  which  provides 
for  approaches  to  a decision  height  (DH)  of  not  less  than  200  feet  and 
visibility  of  not  less  t>ian  1/2  mile  or  RVR  (Runway  Visual  Range)  2500  feet 
(RVR  1800  feet  with  operative  touchdown  zone  and  runway  centerline  lights). 

Cate.^orv  II  operations.  An  instrument  approach  procedure  which  provides 
approaches  to  minima  of  less  than  DH  200  feet/RVR  2400  feet  to  as  low  as  DH 
100  feet/RVP  1200  feet. 

Category  Ilia  operations.  Operations  with  no  decision  height  limita- 
tion, to  and  along  the  surface  of  v.he  runway  with  external  visual  veferer.ee 
during  the  final  phase  of  the  landing  and  with  runway  visual  range  not  less 
than  700  feet. 

Category  Illb  operations.  Operations  with  no  decision  height,  to  and 
along  the  surface  of  the  runway  with  runway  visual  range  not  less  than  150 
feet  and  with  reliance  on  the  system  for  part  or  all  of  the  rollout  along 
the  runway  and  with  external  visual  reference  for  guidance  along  the  taxi- 
way. 


Category  IIIc  operations.  Operation  with  no  decision  height,  to  and 
along  the  surface  of  the  runway  and  taxiways  without  reliance  on  external 
visual  reference. 

Channel . The  term  describing  a single  signal  or  control  path  within  a 
device  or  system  that  may  contain  many  paths.  A channel  is  an  entity  within 
itself  and  contains  elements  individual  to  that  channel.  A model  may  be  used 
as  a reference  channel  in  a detection-correction  system. 

Classes . Airplane  cla.sses  are  defined  using  the  MIL-F-8785  definitions 
for  the  following  classes. 
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Small,  light  airplanes  such  as 
Light  Utility 
Primary  trainer 
Light  observation 

Medium  weight,  low- to -medium  maneuverability 
airplanes  such  as 

Heavy  utility/search  and  rescue 
Light  or  medium  transport/cargo/tanker 
Early  warning/electronic  countermeasures/ 
airborne  command,  control,  or  communi- 
cations relay 
Antisubmarine 
Assault  transport 
Reconnaissance 
Tactical  bomber 
Heavy  attack 
Trainer  for  Class  IT 

Large,  heavy,  low-to-medium  maneuverability  air- 
planes such  as 

Heavy  transport/cargo/tanker 
Heavy  bomber 

Patrol/carly  warning/electronic  counter- 
measures/airborne command,  control,  or 
communications  relay 
Trainer  for  Class  III 

High-maneuverability  airplanes  such  as 
Fighter /intercept or 
Attack 

Tactical  reconnaissance 
Observation 
Trainer  for  Class  IV 

Where  MIL-F-83300  applies,  the  corresponding  MIL-F-83300,  Class  I, 
II,  or  III  or  IV  iipplles. 

Comparison  monitor.  A device  which  compares  signals  and  warning  out- 
puts from  two  or  more  sources  and  provides  its  own  signal  to  Indicate  that 
the  two  or  more  outputs  are  within  or  outside  specified  tolerances. 

Control  wheel  (stick)  steering.  An  AFCS  mode  which  permits  pilot 
manual  control  Inputs  to  be  Introduced  into  the  system  through  the  wheel  or 
stick  when  the  AFCS  is  engaged  and  controlling  the  airplane. 

Damping  ratio.  The  equivalent  second  order  viscous  damping  ratio.  The 
critical  damping  ratio  is  defined  as  unity. 

Decision  height.  Decision  height,  with  respect  to  operation  of  air- 
craft means  the  height  at  which  a decision  must  be  made  during  an  ILS 
(Instrument  Landing  Svstem)  or  PAR  (Precision  Approach  Radar)  instrument 
approach  to  either  continue  the  approach  or  to  execute  a missed  approach. 


Class  I 


Class  II 


Class  III 


Class  IV 
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This  height  Is  expressed  In  feet  above  runway  datum  altitude  and  for 
Category  II  ILS  operations,  the  height  Is  additionally  expressed  as  a 
radio  altimeter  reading. 


Dual  load  path.  A type  of  passive  paralleling  wherein  two  separate 
load  carrying  paths  exist.  Each  load  path  Is  capable  of  carrying  suffi- 
cient load  such  that  failure  of  either  member  will  not  jeopardise  system 
performance. 


Electrical  flight  control  system  (EFCS) . A flight  control  system 
wherein  one  or  more  axes  of  vehicle  control  Is,  at  one  point  or  another, 
completely  electrical.  Hon-electrlcal  backup  or  other  reversion  means  may 
exist.  Electrical  flight  control  Is  conaonly  referred  to  as  fly-by-wlre, 
especially  where  the  application  Is  either  manual  or  essential. 


Essential  FCS.  See  1.2. 3.1 


Extremely  re?!!ote.  The  probability  of  an  event  occurring  which,  although 
theoretically  possible.  Is  not  expected  in  the  life  of  an  Individual  air- 
craft. For  the  purpose  of  this  specification,  the  extremely  remote  proba- 
bility for  a specific  aircraft  Is  defined  as  numerically  equal  to  the  maximum 
aircraft  loss  rate  due  to  relevant  FCS  material  failures  specified  In  3.1.7. 

Failure.  The  Inability  of  an  Item  to  perform  within  previously  speci- 
fied limits. 

Failure  rate.  The  number  of  failures  of  an  Item  per  unit  measure  of 
life  (flights,  time,  cycles,  events,  miles,  etc.)  as  applicable  for  the  Item. 

FCS  operational  states.  See  1.2.2 

Firmware . A set  of  binary  machine  language  instructions  stored  In 
read-only  memory  In  a computer  for  the  purpose  of  providing  a step-by-step 
contivol  of  the  processor. 

Flight  control  system.  See  1 . 1 

Flight  gj rector  subsystem.  A subsystem  which  provides  the  pilot  a dis- 
play of  actual  nnd  desired  flight  parameters.  Uhen  operating  In  a flight 
director  mode,  the  pilot's  task  Is  to  ulnimlzn  the  difference  between  the 
displayed  actual  and  desired  values  through  control  actions. 

Flight  envelopes.  Flight  envelopes  referred  within  this  specification 
are  defined  in  MIL-F-8785  and  MIL-F-83300. 

Flight  phase  essential  tCS.  See  1.2. 3. 2 

Fully-powered  control  system.  See  power-ooerated  control 

Inflight  monitoring.  Continuous  automatic  monitoring  of  system  per- 
formance, normally  performed  Inflight  as  a safety  check. 

Manual  flight  control  system.  See  1.2  1.1 
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Nonaerodynamic  loops.  Inner  feedback  loopa  within  an  fCS  which  do 
not  rely  on  aerodynanlca  for  loop  closure.  Exanplcs  Include  AFCS  servo 
loops  and  actuator  feedback  loopa. 

Noncrltlcai  FCS.  See  1.2. 3. 3 

Power-boosted  control.  A reversible  control  wherein  pilot  effort  is 
exerted  through  mechanical  linkages  and  is  boosted,  directly  in  proportion 
to  the  input,  by  a power  source. 

Power-operated  control.  An  irreversible  control  wherein  the  pilot, 
through  mechanical  linkages  or  other  means,  actuates  a power  control  package 
to  control  an  aerodynamic  surface  or  other  device. 

Random  failure.  Any  failure  %iho8e  occurrence  is  unpredictable  in  an 
absolute  sense  which  is  predictable  only  in  a probabilistic  or  statistical 
sense.  Random  failures  are  those  which  cannot  be  attributed  to  wearout, 
defective  design,  or  abnormal  stress,  and  can  occur  at  any  time  within  the 
equipment's  useful  life. 

Redundancy . A design  approach  such  that  two  or  more  independent  fail- 
ures, rather  than  a siasle  fallur.^,  are  required  to  produce  a given  undesir- 
able condition.  Redundancy  may  take  the  form: 

a.  Providing  two  or  more  components,  subsystems,  or  channels, 
each  capable  of  performing  the  given  functions. 

b.  Monitoring  devices  to  detect  failures  and  accomplish  annunci- 
ation and  automatic  disconnect  or  automatic  switching. 

c.  Combination  of  the  two  above  features. 

Relevant  failure.  Any  random  or  normal  wearout  failure  occurring  in 
service  prior  to  end  of  specified  service  life  when  the  equipment  is  properly 
operated  within  design  load  and  environmental  limits.  A normal  wearout  fail- 
ure is  relatively  Improbable  on  a new  part,  but  undergoes  a relatively  rapid 
rise  in  probability  of  occurrence  after  an  extended  period  of  service  (oper- 
ating hours  or  calendar  time).  Wearout  is  typical  of  seals,  bearings,  motor 
brushes,  fatigue-critical  structure,  etc.  A realistic  system  reliability 
computation  must  include  proper  allowance  for  such  failures  wherever  they 
are  not  avoided  by  scheduled  replacement /overhaul  procedures  in  service. 

Reversion.  The  capability  to  revert  to  a backup  or  cilternate  control 
from  the  normal  control  means.  The  alternate  control  may  use  mechanlca).  or 
electrical  signal  transmission  and  powered  actuation. 

Software.  A set  of  Instructions  Intended  to  be  stored  in  progranmable 
memory  of  a computer  for  the  purpose  of  providing  step-by-step  control  to 
th  proces:<or.  This  Includes  source  program  instructions  requiring  assembly 
ur  compilation  as  well  as  binary  machine  language  instructions. 

Turbulence  cumulative  exceedance  probability.  The  cumulative  proba- 
bility of  experiencing  turbulence  at  an  intensity  equal  to  or  exceeding  a 
given  level.  This  probability  accounts  for  both  the  probability  of  encounter- 
ing turbulence  and  the  distribution  of  the  RMS  Intensity  of  the  turbulence, 
if  encountered. 
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Variable  geometry  control  syatwa.  Those  components  and  subsystems 
which  transmit  control  commands  from  the  pilot  (s)  and  which  produce  forces 
and  moments  to  change  the  aerodynamic  configuration  of  the  aircraft. 
Variable  geometry  controls  Include  those  for  changing  wing  sweep  angle  and 
wing  incidence  angle,  folding  wing  tips,  deploying  canard  surfaces,  and 
varying  the  angle  of  the  nose  of  the  aircraft  with  the  body. 

6.7  Use  of  limited  coordination  apecif ications.  Limited  coordination 
Military  Specifications  may  be  used  when  such  are  in  effect  on  the  date 

of  invitation  for  bid  or  request  for  proposal.  These  specifications  carry 
prefixes,  such  as  MIL-A-008860A  (USAF)  in  lieu  of  MIL-F-8860  (ASG). 

6.8  Identification  changes.  Asterisks  are  not  used  in  this  revision  to 
identify  changes  with  respect  to  the  previous  iscue,  due  to  the  extensive- 
ness of  the  changes. 
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APPENDIX  A 


DERIVATION  OF  RELIABILITY  REQUIREMENTS 
FROM  ACTUAL  FIELD  SAFETY  EXPERIENCE  DATA 

A broad  cross-section  (over  ten  years)  of  pertinent  aircraft  accident  and  loss  experience  was 
obtained  on  typical  large  multiengine  aircraft,  fighter  aircraft,  and  helicopters  from  the  Air  Force 
Safety  and  Inspection  Center,  Norton  Air  Force  Base,  California.  Safety  experience  for  the  B-52, 
C-135  and  C-141  was  examined  to  establish  typical  flight  safety  reliability  requirements  for 
MIL-F-8785  Class  III  aircraft.  The  F-4  was  selected  as  typical  of  MIL-F-8785  Class  1,  II  and  IV 
aircraft  and  the  H-1,  H-3,  H-43,  and  H-53  experience  is  summarized  as  typical  for  helicopters.  Tlie 
following  summarizes  pertinent  flight  safety  experience  on  the  above  listed  aircraft  for  the  period 
January  1962  through  May  1973.  Experience  on  aircraft  introduced  after  January  1962  is  from 
year  of  introduction  through  May  1973. 


B-52  Experience  1962  - May  1973 


Major  Accident  Rate  = 

1.100/100,000  flight  hours 
8.583/100,000  fliglits 

Aircraft 

Major  Accidents  Material  Failure 

Total  Acc. 

Destroyed 

Primary  Cause  - 

100,000  FH 

0.275 

0.175 

100,000  Fliglus 

2.145 

1 .365 

By  System 

Airframe  - 

100,000  FH 

0.125 

0.100 

100,000  FUghts 

0,975 

0.780 

Brakes  - 

100,000  FH 

0.050 

0.050 

100,000  Flights 

0.390 

0.39C 

Pneumatic 

100,000  FH 

0.025 

0.025 

100,000  Flights 

0.195 

0.195 

Engine 

100,000  FH 

0.025 

— 

100,000  Fliglits 

0.195 

- 

Fliglit  Control 

100,000  FH 

0.025 

— 

100,000  Flights 

0.195 

- 

Landing  Gear 

100,000  FI  I 
100,000  FUglits 

0.025 

0.195 

- 

B-52  experience  covered  3,998,61 1 flight  hours  and  approximately  51 2,642  flights. 
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C-141  Experience  1964 -May  1973 


Major  Accident  Rate  = 

0.1 89/100,000  fliglit  hours 
1.439/100,000  nights 

Aircraft 

Total  Acc. 

Destroyed 

Major  Accidents  Material  Failure 

Primary  Cause  - 

100,000  FH 

0.108 

- 

100,000  FUghts 

0.822 

— 

By  System 

Airframe  - 

100,000  FH 

0.054 

- 

100,000  Flights 

0.411 

- 

Hydraulics 

100,000  FH 

0.027 

— 

100,000  Flights 

0.206 

— 

Brakes 

100,000  FH 

0.027 

_ 

100,000  Flights 

0.206 

- 

C-141  experience  covered  3,698,192  flight  hours  and  approximately  486,604  flights. 

C-135  Experience  1962  - 

May  1973 

Major  Accident  Rate  = 

0.923/100,000  Fliglit  Hours 
5.075/100,000  Fliglits 

Total  Acc. 

Aircraft 

Destroyed 

Major  Accidents  Material  Failure 

Primary  Cause  - 

100,000  FH 

0.154 

0.066 

100,000  Fliglits 

0.846 

0.363 

By  System 

Airframe  - 

100,000  FH 

0.022 

0.022 

100,000  Fliglits 

0.121 

0.121 

Landing  Gear  - 

100,000  FH 

0.044 

— 

100,000  Flights 

0.242 

— 

Engine  - 

100,000  FH 

0.066 

0.022 

100,000  Flights 

0.363 

0.121 
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Total  Acc. 


Aircraft 

Destroyed 


Fuel  - 100,000  FH 

100,000  Flights 


0,022  0.022 

0.121  0.121 


C-135  experience  covered  4,552,143  flight  hours  and  approximately  827,662  flights. 


B-52/C-13S/C-141  Combined  Experience  1962  • May  1973 

M^or  Accident  Rate  = 0.759/100,000  Fught  Hours 

5.091/100,000  FUghts 


Aircraft 


M^or  Accidents  Material  Failure 
Primary  Cause  - 100,000  FH 

Total  Acc. 
0.180 

Destroyed 

0.082 

100,000  FUghts 

1.204 

0.547 

By  System 

Airframe  - 

100,000  FH 

0.065 

0.041 

100,000  FUghts 

0.438 

0.274 

Brakes  • 

100,000  FH 

0.024 

0.016 

100,000  Flights 

0.164 

0.109 

Engine  - 

100,000  FH 

0.032 

0.008 

100,000  FUghts 

0.219 

0.055 

Landing  Gear 

100,000  FH 

0.024 

100,000  FUghts 

0.164 

- 

Fuel  - 

100,000  FH 

0.008 

0.008 

100,000  Flights 

0.055 

0.055 

Pneumatic 

100,000  FH 

0.008 

0.008 

100,000  FUghts 

0.055 

0.055 

Flight  Control 

100,000  FH 

0.008 

_ 

100,000  FUghts 

0.055 

- 

Hydraulics  - 

100,000  FH 

0.008 

_ 

100,000  FUghts 

0.055 

— 

The  combined  B-52/C-I35/C'141  experience  covered  12,248,946  flight  hours  and  approximately 
1,826,908  flights. 
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F4  Experience  - 1964  - May  1973 


Major  Accident  Rate  = 

7.748/100,000  Flight  Hours 
12.398/100,000  Flights 

Total 

Aircraft 

Destroyed 

Major  Accidents  Material  Failure 
Primary  Cause  - 100,000  FH 

100,000  FUgltts 

1.974 

3.158 

1.486 

2.378 

By  System 

Airframe  - 

100,000  FH 
100,000  Fligh.ts 

0.049 

0.078 

0.024 

0.039 

Landing  Gear  - 

100,000  FH 
100,000  FUghts 

0.292 

0.468 

0.049 

0.078 

Fliglit  Controls  - 

100,000  FH 
100,000  FUglits 

0.341 

0.546 

0.341 

0.546 

Fuel  - 

100,000  FH 
100,000  Flights 

0.170 

0.273 

0.170 

0.273 

Electrical  - 

100,000  FH 
100,000  Flights 

0.073 

0.117 

0.073 

0.117 

Hydraulic 

100,000  FH 
100,000  Fliglits 

0.219 

0.351 

0.219 

0.351 

Ordnance  - 

100,000  FH 
100,000  FliglUs 

0.073 

0.117 

0.049 

0.078 

Instruments  - 

100,000  FH 
100,000  FUghts 

0.024 

0.039 

0.024 

0.039 

Brakes  - 

100,000  FH 
100,000  FUghts 

0.122 

0.195 

0.049 

0.078 

Pneumatic  - 

100,000  FH 
100,000  FliglUs 

0.073 

0.117 

0.024 

0.039 

Powerplant 
Components  - 

100,000  FH 
100,000  FUghts 

0.049 

0.078 

0.049 

0.078 

Engine  - 

100,000  FH 
100,000  Flights 

0.439 

0.702 

0.390 

0.624 
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Miscellaneous 


Total  Acc. 


Aircraft 

Destroyed 


100,000  FH  0.049 

100,000  Flights  0.078 

F-4  experience  covered  4,103,851  flight  hours  and  approximately  2,564,907  flights. 


H-1  Experience  1962  - May  1973 

Major  Accident  Rate  ■ 5.862/100,000  Flight  Hour 

8.091/100,000  Rights 


Total 

Major  Accidents  Material  Failure 


Primary  Cause  • 

100,000  FH 

1.832 

100,000  Flights 

2.528 

By  System 

Flight  Control  - 

100,000  FH 

0.183 

100,000  FUghts 

0.253 

Hydraulics  • 

100,000  FH 

0.183 

100,000  Flights 

0.253 

Powerplant 

100,000  FH 

1.099 

Components  • 

100,000  FUghts 

1.517 

Engine  - 

100,000  FH 

0.366 

100,000  Flights 

0.505 

0.024 

0.039 


Aircraft 

Destroyed 


1.832 

2.528 


0.183 

0.253 

0.183 

0.253 

1 .0^^ 
1.517 


H-1  experience  covered  545,796  flight  houre  and  approximately  395,504  flights 


0.366 

0.505 


H-3  Experience  - 1963  - 

May  1973 

Major  Accident  Rate  = 

5.637/100,000  Flight  Hours 
10.203/100,000  Flights 

Total  Acc. 

Aircraft 

Destroyed 

Major  Accidents  Material  Failure 

Cause  - 100,000  FH 

100,000  Flights 

0.752 

1.360 

0.511 

0.925 

By  System 

Powerplant 
Components  - 

100,000  FH 
100,000  Flights 

0.752 

1.360 

0.511 

0.925 

H-3  experience  covered  266,075  fli«;ht  hours  and  approximately  147,002  flights. 

H-43  Experience  - 1962 

-May  1973 

Major  Accident  Rate  = 7.231/100,000  Flight  Hours 

7.158/100,000  FUghts 


Aircraft 

Total  Acc.  Destroyed 

Major  Accidents  Material  Failure 


Primary  Cause  - 

100,000  FH 

1.534 

0.657 

100,000  Flights 

1.518 

0.650 

By  System 

Flight  Controls  - 

100,000  FH 

0.219 

0.219 

100,000  Flights 

0.216 

0.216 

Engine  - 

: 00,000  FH 

1.314 

0.438 

100,000  Flights 

1.301 

0.434 

H43  experience  includes  456,362  flight  hours  and  approximately  460,971  flights. 
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H~S3  Experience  • 1966  - May  1973 


Msjor  Accident  Kate  = 3.644/100,000  Flight  Hours 

8.091/100,000  Flights 


Aircraft 

Total  Acc. 

Destroyed 

Major  Accidents  Material  Failure 
Primary  Cause  - 100,000  FH 

0 

0 

100,000  Flights 

0 

0 

H-S3  experience  included  82,316  flight  hours  and  approximately  37,079  flights. 


H-l/t  -3/H43/H-53  Combined  Experience  1962 -May  1973 

Aiiv  i Accide  ^ate  = 6.145/100,000  Flight  Hours 

7.976/100,000  Flights 


Aircraft 

Total  Acc.  Destroyed 

Major  Accidents  Material  Failure 


Primary  Cause  • 

100,000  FH 
100,000  Flights 

1.407 

1.826 

1.037 

1.345 

By  System 
Engine  - 

IOC  000  FH 
100,000  Flights 

0.592 

0.769 

0.296 

0.384 

Powerplant 
Components  - 

0,000  FH 
i 00 ,000  FUghts 

0.592 

0.769 

0.518 

0.672 

Flight  Controls  - 

100,000  FH 
100,000  Flights 

0.148 

0.192 

0.148 

0.192 

Hydraulics  - 

100,000  FH 
100,000  Flights 

0.074 

0.096 

0.074 

0.096 

The  combined  helicopter  experience  includes  1 ,350,549  hours  and  approximately  1 ,040,566  flights. 

Although  the  F-1 1 1 is  not  considered  typical  of  USAF  fighter  operations,  the  experience  is  included 
here  for  information.  The  rates  are  not  considered  in  Figures  A-1  through  A-3  but  are  shown 
individually  in  Figure  A6. 
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F-1 1 1 Experience  1965  • May  1973 


Mi^or  Accident  Rate  « 13.391/100,000  Flight  Hours 

36.825/100,000  Flights 


Aircraft 

Total  Acc.  Destroyed 

Total  Major  Accidents  Material  Failure 


Primary  Cause  - 

100,000  FH 

6.003 

3.694 

100,000  nights 

16.508 

10.159 

By  System 

Flight  Controls  - 

100,000  FH 

1.847 

1 385 

100,000  Flights 

5.079 

3.809 

Airframe  - 

100,000  FH 

1.385 

0.924 

100,000  Rights 

3.809 

2.539 

Air  Cond. 

100,000  FH 

0.924 

Pressurization  - 

100,000  Flights 

2.5*39 

- 

Landing  Gear  - 

100,000  FH 

0,462 

0.462 

100,000  Rights 

1.270 

1.270 

Engine  • 

100,000  FH 

0.462 

— 

100,000  Flights 

1.270 

Fuel  - 

100.000  FH 

0.462 

0.462 

100,000  Flights 

1.270 

1.270 

Ordnance  - 

100,000  FH 

0.462 

0.462 

100,000  FUghts 

1.270 

1.270 

Figure  A1  depicts  the  accident  rates  in  terms  of  100,000  flight  hours,  and  illustrates  how  the 
accident  experience  on  the  aircraft  measured  falls  into  three  distinct  safety  levels. 

Figure  A2  portrays  the  same  information  measured  in  terms  of  number  of  flights,  rather  than  flight 
hours.  Helicopter  and  large  aircraft  experience  is  more  closely  aligned  when  measured  in  number  of 
flights. 

Figures  A3,  A4,  and  AS  illustrate  the  potential  and  actual  aircraft  loss  rates  due  to  material  failure 
in  individual  aircraft  systems. 

For  the  purpose  of  this  report,  aircraft  systems  are  as  defmed  in  Air  Force  Inspection  and  Safety 
Center  Manual  127-1  (AFISCM  127-1)  dated  1 January  1972.  Flight  control  system  includes  the 
flight  control  surfaces,  control  and  actuation,  electro-hydro-mechanical  components,  automatic 
flight  control,  but  not  the  power  source  systems,  or  portions  thereof. 
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Figure  Al.  Aircraft  major  accidents  - Material  failure  primary  cause 
• Per  100,  (WO  hoiurs 


3.16 
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FIGHTER  HELICOPTER  BOMB 

AIRCRAFT  TRAN 

Figure  A2.  Aircraft  major  accidents  > Material  fattwe  primary  cause 
- Per  100, 000  flights 


POTENTUL/ACTUAL 


Figure  A3.  Fbtential  and  actual  material  failure  aircraft  loss  rates  (fighter  aircraft) 


ACTUAL 


Potential  and  actual  material  failure  aircraft  loss  rates  (helicopter  aircraft) 


POTENTIAL  AND  ACTUAL 


Figure  A6,  Potential  and  actual  material  failure  aircraft  loss  rates  (F-111  aircraft) 


APPENDIX  B 


METHODS  OF  DETERMINING  COMPONENT  OR  SUBSYSTEM  RELIABILITY 
INCREASES  REQUIRED  TO  COMPENSATE  FOR  BLIND  REDUNDANCIES 

In  the  DISCUSSION  of  ParaRraph  3. 1.7. 1,  Reliability  - Right  Safety,  it  was  noted  that  it  will  not 
always  be  possible  to  determine  that  all  subsystems  and  components  are  failure-free  and  operable 
before  each  flight.  Therefore,  since  the  basic  reliability  requirements.  Q(t)p  § , are  stated  in  terms 
of  the  probability  of  aircraft  loss  due  to  FCS  failure  during  single  flights  of  specified  duration,  it  is 
necessary  to  properly  compensate  for  such  blind  redundancies. 

SOLUTIONS  OF  ELEMENTARY  BLIND  REDUNDANCIES 

Redundant  subsystems  are  usually  analyzed  on  the  assumption  that  all  elements  are 
unfailed  at  the  start  of  a mission;  hence  subsystem  failure  generally  involves  the  occurrence  of  two 
or  me  V independent  failures  during  the  same  mission. 

In  many  practical  eases,  there  are  one  or  more  elements  that  are  not  checked  between 
missions  and  whose  failure  is  not  ordinarily  detectable  in  fliglU  unless  other  elements  also  fail.  In 
such  cases,  of  course,  the  usual  assumption  that  all  elements  are  unfailed  at  the  start  of  the  mission 
would  lead  to  erroneous  subsystem  reliability  predictions. 

Tlie  two  simplest  cases  are  solved  as  outlined  below. 

Case  1 • Single-Blind  Redundancy 

Assume  two  components  A and  B in  parallel.  Failure  of  A alone  is  not  ordinarily 
noticeable,  and  it  is  not  considered  feasible  to  check  the  true  condition  of  A between  flights. 
Component  A is,  however,  checked  in  a scheduled  inspection  at  intervals  of  Tj  flight  hours. 

Failure  of  Component  B is  readily  noticeable,  and  it  will  receive  maintenance  before 
the  next  flight  if  failure  is  observed. 

Consider  one  inspection  interval  of  Tj  hours,  during  which  time  the  aircraft  flies  n 
missions  of  Tj^  hours  each.  The  subsystem  fails  if  B fails  and  A fails  either  during  the  same  mission 
or  during  any  earlier  mission  during  the  given  inspection  interval  Tj.  The  resulting  average  mission 
reliability  is  derived  as  shown  in  Ta*'le  Bl . 
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TABLE  B! 

SOLUTION  OF  SINGLE-BLIND  REDUNDANCY 


Components  A and  B in  parallel.  Component  A has  constant  hourly  failure  rate  Xj^,  and  its 
condition  is  checked  only  at  intervals  of  T|  hours.  Component  B ha>  constant  hourly  failure  rate 
Xg,  and  its  condition  is  checked  each  mission.  Mission  duration  is  Tj^  hours.  Tj/Tj^  =*  n = number 
of  missions  flown  during  one  Tj  inspection  interval. 


Probability  A fails  during  Tj^ 

CLASSICAL  METHOD 
(Component  unreliability 
taken  asj  .g*XT) 

APPROXIMATE  METHOD 
(Component  unreliability 
taken  as  XT) 

1 - e'^A'^'M 

XaTm 

Probability  B fails  during  Tj^ 

1 - e-XB^M 

^b’^m 

Probability  A and  B both  fail 
during  first  mission  of  interval 
Tl 

(1  -e'^A'^MKl  - 
e-^B^M) 

Xa^sTm^ 

Probability  subsystem  fails 
on  the  Kth  mission,  due  to  failure 
of  A at  any  time  during  the  first 
K missions  combined  with  failure 
of  B during  the  Kth  mission. 

(1 -e**^A'^MKl  * 
c'^b'^M) 

KXaXbTm^ 

Total  probability  of  subsystem 
failure  during  the  interval 

id  -e'^^^A^M) 
K*\ 

(1  -e'^B^) 

1 

I 

KX^XbTm^ 

-(1+2+. . . .+n)(XAXgTM2) 

=(2X5+1)  XaXbT„2 

Average  probability  of  sub- 
system failure  during  one  of 
the  above  n missions; 
0(t)sYS 

1 „.«KXaTm, 

(1  -e'^B^M) 

1 

inK|tL)  x^XbTm^ 

^(2^  XaXbTm^ 

~ 2n  ^A^b'^m’^I 

Case  II  - Double-Blind  Redundancy 


In  this  case,  neither  component  is  checked  except  at  scheduled  inspection  intervals  of 
Tj  flight  hours.  The  subsystem  fails  if  both  A and  B fail  during  the  interval  Tj.  The  resulting  average 
mission  reliability  is  derived  as  shown  in  Table  B?  . 
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TABLE  B2 


SOLUTION  OF  DOUBLE-BLIND  REDUNDANCY 

Components  A and  B in  paralle*,  with  constant  hourly  failure  rates  and  Xg,  respectively.  Failure 
of  either  component  alone  is  not  noticeable.  Components  not  checked  in  preflight.  Both 
components  are  checked  at  intervals  of  T|  hours.  Mission  duration  is  Tm  hours.  Tj/Tj^  = n * 
number  of  missions  flown  during  one  T|  inspection  interval. 


CLASSICAL  METHOD 
(Component  unreliability 
taken  asj  .e*XT) 

APPROXIMATE  METHOD 
(Component  unreliability 
taken  as  XT) 

Probability  A fails  during  Tj 

1 - e'^B'^'l 

XaTi 

Probability  B fails  during  T| 

1 - e'^B”^! 

^b'^i 

Probability  A and  B both  fail 
during  T| 

(1  -e-^A'^I)  (1  -e’^B^I) 

XaXj|T,2 

Average  mission  unreliability 
0(t)sYS 

i 

(TOd  -e'^A'^'l)  (1  -e‘^B'^1) 

i 

4)  ^A^B^I^ 
“ ^A^b'^m"^! 

In  the  typical  practical  case,  the  difference  between  the  “Classical”  and 
“Approximate”  methods  per  Tables  Bl  and  B2  is  trivial.  If  any  of  the  XT  products  are  fairly  large 
(say,  O.IO  or  more),  the  difference  between  the  two  solutions  may  become  significant.  The  two 
methods  provide  an  upper  bound  and  a lower  bound,  between  which  the  true  answer  lies.  The 
“Qassical”  method  is  slightly  unconservative,  as  it  neglects  the  probability  of  two  or  more 
subsystem  failures  during  the  same  T|  inspection  interval.  The  “Approximate”  method  is  slightly 
conservative.  A completely  precise  and  rigorous  approach  yields  such  a cumbersome  solution  that  it 
is  impracticable. 

It  is  apparent  from  the  “Approximate  method”  columns  of  Table  Bl  and  Table  B2 
that  the  single-blind  redundance  yields  approximately  half  the  subsystem  unreliability  of  the 
double-blind  redundancy.  The  factor-^^  approaches  0.5  for  large  values  of  n.. 

TYPICAL  EXAMPLES 

For  a typical  example  of  the  three  possible  cases  of  no-blind  redundancy,  single-blind 
redundancy,  and  double-blind  redundancy  in  a simple,  two-element  subsystem,  consider  the 
following; 

a.  An  actuating  subsystem  with  two  actuators:  one  hydraulic  and  one  emergency 
pneumatic. 

b.  The  maximum  allowable  failure  rate  for  the  subsystem  is  Q(t>sYS  “ ^ 

failures/flight,  considering. 
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c.  An  average  flight  duration  of  Tm  = 1 .5  hours. 

d.  A hydraulic  actuator  with  a known  failure  rate  of  = 2.0  x lO"^  failures/hour 
is  used. 

The  reliability  requirement  for  the  pneumatic  actuator,  Xp,  is  solved  for  the  three  cases. 

Case  I,  No-Blind  Redundancy 

Both  actuators  are  checked  prior  to  each  fli^t: 

Q(t^)p  = _ — 9.0  xJ_oj — _ 3 Q ^ jq-4  failures/flight 

Q<Wh  2.0  X 10-^  X 1.5 

then  Xp  must  be  ~ 2,0  x lO"^  failures/hour. 


Case  II,  Single-Blind  Redundancy 

The  hydraulic  actuator  is  checked  before  each  flight,  but  the  pneumatic  actuator  is 
checked  only  once  a month;  an  inspection  interval  of  T j = 30  flight  hours  during  which  time  the 
aircraft  flies  n = 20  missions  of  T]^  = 1 .5  hours  each. 

Referring  to  Table  Bl,Q(t)sYs  = (^)  X^  • Xg  • T^^  . Tj 
•^A  ~ tn+j;  Xg  . T|^  , Tj  . and  for  this  problem: 


V ^ .In  Q<^>SYS  ^ 40  9.0  X 10~^ 

P n+1  Xh  . T^i  . Tj  21  ■ 2.0x10"^  • 1 .5  • 30 
Xp  must  be  1.9  x 10'^  failures/hr. 


Case  III,  Double-Blind  Redundancy 

Both  actuators  are  checked  only  once  a month:  an  inspection  interval  of  T|  = 30  flight 
hours  during  wluch  time  the  aircraft  flies  n = 20  missions  of  T|^  = 1 .5  hours  each. 

Referring  to  Table  B2,Q(t)gYS  ~ ^A^B^M^l 

^ 9.0  x IQ-^  

P . T^  . T,  2.0  X 10^  ‘ 1.5  ■ 30 

Xp  must  be  1 .0  x 10'^  failures/hour. 
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